{"id":6394,"date":"2020-03-11T22:34:44","date_gmt":"2020-03-11T22:34:44","guid":{"rendered":"https:\/\/www.n-able.com\/?p=6394"},"modified":"2022-06-10T18:22:30","modified_gmt":"2022-06-10T17:22:30","slug":"march-2020-patch-tuesday-update-115-individual-cves","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves","title":{"rendered":"March 2020 Patch Tuesday Update: 115 individual CVEs"},"content":{"rendered":"<p>Last month I commented on the sheer size of the fixed vulnerabilities in Microsoft\u2019s February Patch Tuesday release. Well, leave it to Microsoft to one-up me on that number. The March release contains fixes for 115 individual CVEs\u201426 of which are rated \u201cCritical\u201d and 88 \u201cImportant\u201d\u2014with a spread across operating systems, browsers, applications, and a few interesting ones we\u2019ll review here.<\/p>\n<h3>Critical operating system vulnerabilities<\/h3>\n<p>There are seven vulnerabilities marked \u201cCritical\u201d for operating systems. These include fixes for Server 2008 and Windows 7 that are only available via the Extended Security Updates (ESU). There are a few important things to note about this month\u2019s \u201cCritical\u201d patches. They are all listed as \u201cExploitation Less Likely\u201d, with no \u201cExploitation Detected\u201d or \u201cExploitation More Likely\u201d ratings. That usually indicates that Microsoft doesn\u2019t expect these vulnerabilities to be exploited easily.<\/p>\n<p><a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0684\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0684<\/a>\u00a0is a \u201cRemote Code Execution\u201d vulnerability that would allow an attacker to gain the same rights as a user if that user were tricked into clicking on a .LNK file. This vulnerability affects all operating systems from Windows 7 up to current versions of Windows 10, and their corresponding Server versions.<\/p>\n<p>The next group consists of four Media Foundation Memory Corruption vulnerabilities. They all have the same description, stating that an attacker could convince a user to open a document or visit a malicious web page. This would give the attacker the ability to add, modify, create, or delete data or accounts on the affected systems.\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0801\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0801<\/a>,\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0809\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0809<\/a>,\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0869\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0869<\/a>, and\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0807\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0807<\/a>\u00a0affect Windows 10 versions, as well as the Server versions from 2016 up to current.<\/p>\n<p>Finally,\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0881\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0881<\/a>\u00a0and\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0883\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0883<\/a>\u00a0are both in the Windows Graphics Device Interface (GDI) and are related to how objects are handled in memory. If a user were tricked into visiting a website or opening an attachment, this vulnerability would allow the attacker to gain full rights to the affected system. All versions from Windows 7 up to current (including Server operating systems) are impacted.<\/p>\n<h3><b>Browser vulnerabilities<\/b><\/h3>\n<p>There are 17 \u201cCritical\u201d vulnerabilities in browsers this month. Six of them are in Internet Explorer 11 on Windows 7 up to current Windows 10 versions, while 13 of them affect the \u201cEdgeHTML\u201d version of the Edge browser on Windows 10.<\/p>\n<h3><b>Other applications<\/b><\/h3>\n<p>There is a total of nine CVEs fixed in Office this month, one of which is marked \u201cCritical\u201d.\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0852\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0852<\/a>\u00a0is a \u201cRemote Code Execution\u201d vulnerability that would require a user to open a specially crafted file and would allow the attacker to gain the same permissions as the logged-on user. Microsoft notes that the Preview Pane is an attack vector for this one, so you may want to prioritize Office updates this month. This vulnerability affects Microsoft Office 2016 for Mac, SharePoint Server 2019, and Office 2019.<\/p>\n<p>The remaining \u201cImportant\u201d vulnerabilities are focused on \u201cRemote Code Execution,\u201d \u201cSpoofing,\u201d and one \u201cInformation Disclosure\u201d vulnerability and affect versions of Office, including SharePoint Server, Word, and ProPlus.<\/p>\n<p><b>Microsoft Exchange Server<\/b>\u00a02016 and 2019 have one \u201cImportant\u201d cross-site-scripting vulnerability that would allow an attacker to act as another user. The fix for\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0903\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0903<\/a>\u00a0addresses how Exchange handles web requests.<\/p>\n<p><b>Microsoft Dynamics<\/b>\u00a0has a \u201cCritical\u201d vulnerability,\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0905\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0905<\/a>. This vulnerability is in Business Central, and the fix prevents the use of binary types that could execute code on the server itself.<\/p>\n<p>Finally,\u00a0<b>Application Inspector<\/b>\u00a0has one fix for\u00a0<a class=\"ext\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0872\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2020-0872<\/a>\u00a0, which would allow an attacker to execute code if a user was tricked into running Inspector on that code.<\/p>\n<p>In summary, with no active attacks at the time of this publishing, there are no real \u201cemergencies\u201d in this batch. Since most patches are cumulative on Windows 10, start your focus on internet facing workstations, then servers, and then Office.<\/p>\n<p>As I mentioned last Patch Tuesday, we continue to see fixes for Windows 7, and without an ESU subscription, the risk continues to grow for those systems. It is recommended to upgrade to a supported operating system or purchase ESU for these systems. In a situation where that\u2019s simply not possible, it\u2019s critical to ensure other layers of security (Endpoint protection, Mail Protection, URL filtering, Firewall) are properly configured and protecting these systems.<\/p>\n<p>As always, we recommend testing these patches on a small set of systems before approving them for wider deployment.<\/p>\n<p>Let\u2019s stay safe out there!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you thought last month&#039;s Patch Tuesday was big Microsoft ups it&#039;s game again\u2026 Gill Langston looks at what&#039;s in this month&#039;s patch releases.<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-6394","post","type-post","status-publish","format-standard","hentry","topic-head-nerds","topic-patch-management","topic-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>March 2020 Patch Tuesday Update: 115 individual CVEs - N-able<\/title>\n<meta name=\"description\" content=\"If you thought last month&#039;s Patch Tuesday was big Microsoft ups it&#039;s game again\u2026 Gill Langston looks at what&#039;s in this month&#039;s patch releases.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"March 2020 Patch Tuesday Update: 115 individual CVEs - N-able\" \/>\n<meta property=\"og:description\" content=\"If you thought last month&#039;s Patch Tuesday was big Microsoft ups it&#039;s game again\u2026 Gill Langston looks at what&#039;s in this month&#039;s patch releases.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2020-03-11T22:34:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-06-10T17:22:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/03\/share-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Gill Langston\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Gill Langston\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves\"},\"author\":{\"name\":\"Gill Langston\",\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/person\/ccb02e43837727da6ab962f5357e872a\"},\"headline\":\"March 2020 Patch Tuesday Update: 115 individual CVEs\",\"datePublished\":\"2020-03-11T22:34:44+00:00\",\"dateModified\":\"2022-06-10T17:22:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves\"},\"wordCount\":714,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/es#organization\"},\"articleSection\":[\"Head Nerds\",\"Patch Management\",\"Security\"],\"inLanguage\":\"es\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves\",\"url\":\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves\",\"name\":\"March 2020 Patch Tuesday Update: 115 individual CVEs - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/es#website\"},\"datePublished\":\"2020-03-11T22:34:44+00:00\",\"dateModified\":\"2022-06-10T17:22:30+00:00\",\"description\":\"If you thought last month's Patch Tuesday was big Microsoft ups it's game again\u2026 Gill Langston looks at what's in this month's patch releases.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Security\",\"item\":\"https:\/\/www.n-able.com\/es\/blog\/category\/security\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"March 2020 Patch Tuesday Update: 115 individual CVEs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/es#website\",\"url\":\"https:\/\/www.n-able.com\/es\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/es#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/es?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/es#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/es\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/person\/ccb02e43837727da6ab962f5357e872a\",\"name\":\"Gill Langston\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/7e3211da194e6f8c74fccea7140d31255418759757a5d157a8eb4fd12fd0f1f2?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7e3211da194e6f8c74fccea7140d31255418759757a5d157a8eb4fd12fd0f1f2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7e3211da194e6f8c74fccea7140d31255418759757a5d157a8eb4fd12fd0f1f2?s=96&d=mm&r=g\",\"caption\":\"Gill Langston\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"March 2020 Patch Tuesday Update: 115 individual CVEs - N-able","description":"If you thought last month's Patch Tuesday was big Microsoft ups it's game again\u2026 Gill Langston looks at what's in this month's patch releases.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves","og_locale":"es_ES","og_type":"article","og_title":"March 2020 Patch Tuesday Update: 115 individual CVEs - N-able","og_description":"If you thought last month's Patch Tuesday was big Microsoft ups it's game again\u2026 Gill Langston looks at what's in this month's patch releases.","og_url":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2020-03-11T22:34:44+00:00","article_modified_time":"2022-06-10T17:22:30+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/03\/share-image.jpg","type":"image\/jpeg"}],"author":"Gill Langston","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Escrito por":"Gill Langston","Tiempo de lectura":"4 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves"},"author":{"name":"Gill Langston","@id":"https:\/\/www.n-able.com\/es#\/schema\/person\/ccb02e43837727da6ab962f5357e872a"},"headline":"March 2020 Patch Tuesday Update: 115 individual CVEs","datePublished":"2020-03-11T22:34:44+00:00","dateModified":"2022-06-10T17:22:30+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves"},"wordCount":714,"publisher":{"@id":"https:\/\/www.n-able.com\/es#organization"},"articleSection":["Head Nerds","Patch Management","Security"],"inLanguage":"es"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves","url":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves","name":"March 2020 Patch Tuesday Update: 115 individual CVEs - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/es#website"},"datePublished":"2020-03-11T22:34:44+00:00","dateModified":"2022-06-10T17:22:30+00:00","description":"If you thought last month's Patch Tuesday was big Microsoft ups it's game again\u2026 Gill Langston looks at what's in this month's patch releases.","breadcrumb":{"@id":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/es\/blog\/march-2020-patch-tuesday-update-115-individual-cves#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Security","item":"https:\/\/www.n-able.com\/es\/blog\/category\/security"},{"@type":"ListItem","position":2,"name":"March 2020 Patch Tuesday Update: 115 individual CVEs"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/es#website","url":"https:\/\/www.n-able.com\/es","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/es#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/es?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/es#organization","name":"N-able","url":"https:\/\/www.n-able.com\/es","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/es#\/schema\/person\/ccb02e43837727da6ab962f5357e872a","name":"Gill Langston","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/7e3211da194e6f8c74fccea7140d31255418759757a5d157a8eb4fd12fd0f1f2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/7e3211da194e6f8c74fccea7140d31255418759757a5d157a8eb4fd12fd0f1f2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7e3211da194e6f8c74fccea7140d31255418759757a5d157a8eb4fd12fd0f1f2?s=96&d=mm&r=g","caption":"Gill Langston"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/posts\/6394","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/comments?post=6394"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/posts\/6394\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/media?parent=6394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}