Microsoft’s November 2020 Patch Tuesday saw 112 total fixes released for vulnerable Microsoft products. Out of the 112 patches released yesterday, 17 were listed as critical along with a zero-day vulnerability that was actively attacked in the wild. The zero-day revealed by Google last week after being seen in targeted attacks is currently being tracked as CVE-2020-17087 and lies within the Windows Kernel Cryptography Driver (cng.sys). Google stated, “The bug resides in the cng!CfgAdtpFormatPropertyBlock function and is caused by a 16-bit integer truncation issue.
Analyst Notes
All companies should keep an inventory of software versions and systems to check against critical vulnerabilities when they are announced. Although not everything can be patched immediately on production systems, the critical vulnerabilities that have been observed being exploited in the wild should receive the highest priority for patches to be installed as soon as possible. The longer companies wait, the more likely they are to become victims of targeted attacks that exploit the vulnerabilities. It is always advised to back up any important data prior to implementing patches as there have been some cases where it can be lost if a system failure occurs.
To view the full report, please visit: https://www.bleepingcomputer.com/microsoft-patch-tuesday-reports/Nov-2020.html
