Microsoft fixes 'critical' wormable RCE flaw in Windows 10

The latest Patch Tuesday release sees 87 bugs fixed including the CVSS 9.8-rated vulnerability

Person types on laptop in the dark

Microsoft has patched a highly severe vulnerability in the Windows operating system TCP/IP stack, which could have allowed an attacker to execute code on a target server remotely. 

The remote code execution vulnerability, which is wormable, has been fixed as part of a fresh wave of 87 patches as part of the firm’s routine fortnightly Patch Tuesday bug fixes, and is one of 11 critical flaws seen to.

McAfee, which first discovered the wormable vulnerability, has dubbed it ‘bad neighbor’ and branded the proof-of-concept as “both extremely simple and perfectly reliable”. 

Before it was patched, hackers could have exploited the flaw, assigned CVE-2020-16898 and rated 9.8 on the CVSS severity scale, due to the way that the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. This affected users with machines running Windows 10 and Windows Server 2019. 

Doing so would grant the attacker the ability to execute remote code on the targeted client by sending specially crafted ICMPv6 Router Advertisement packets to a remote Windows machine. The update, released yesterday, addresses how the Windows TCP/IP stack handles these packets.

Another notable vulnerability, tagged CVE-2020-16891, is a remote code execution exploit in Windows Hyper-V. This would have allowed an attacker to run a specially crafted programme on an affected guest operating system to execute arbitrary code on the host operating system. 

The full round of fixes applies to bugs found in Windows, Microsoft Office, Azure Functions, Microsoft Exchange Server, Visual Studio, Adobe Flash player, and many other services. Of these 87 bugs, 11 have been deemed critical, while 74 are classed as important, and a further one is categorised as being moderate in severity. There’s no evidence to suggest any of these flaws have been publicly exploited.

Although there are still a handful of serious security threats that Microsoft has addressed, the routine Patch Tuesday round of fixes actually comprises fewer vulnerabilities than businesses have come to expect in recent months. SolarWinds MSP’s head security nerd Gill Langston also claims that this October Patch Tuesday is the first batch that fixes fewer than 100 vulnerabilities

“Don’t be fooled by that, as there are several in this group that do warrant your attention,” he said.

"Pay special attention to the 'Important' ones, as many of them are listed as “Exploitation More Likely” and will be in the priority list. While there are no active attacks according to Microsoft, there is a high likelihood some may appear soon for several of these. While this month’s batch was lighter than usual, there are some real attention getters here.”

Langston has recommended that businesses address the TCP/IP flaw first and foremost, before shifting their attention to getting RDP servers patched, since remote desktop seems to be one of the current most popular attack vectors.

Next, IT admins should focus on patching Hyper-V systems, and then patching workstations, especially those running Outlook, before finally addressing SharePoint servers.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Acer Taiwan falls victim to cyber attack
hacking

Acer Taiwan falls victim to cyber attack

18 Oct 2021
Marsh McLennan reveals its cyber risk analytics center
risk management

Marsh McLennan reveals its cyber risk analytics center

15 Oct 2021
£100 contactless payment limit could place shoppers at risk, warn industry experts
Policy & legislation

£100 contactless payment limit could place shoppers at risk, warn industry experts

15 Oct 2021
Hackers used MSHTML exploit a week before patches were ready
zero-day exploit

Hackers used MSHTML exploit a week before patches were ready

14 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021