{"id":37646,"date":"2020-10-13T20:09:52","date_gmt":"2020-10-13T20:09:52","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/its-2020-and-a-rogue-icmpv6-network-packet-can-pwn-your-microsoft-windows-machine\/"},"modified":"2020-10-13T20:09:52","modified_gmt":"2020-10-13T20:09:52","slug":"its-2020-and-a-rogue-icmpv6-network-packet-can-pwn-your-microsoft-windows-machine","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/its-2020-and-a-rogue-icmpv6-network-packet-can-pwn-your-microsoft-windows-machine\/","title":{"rendered":"It’s 2020 and a rogue ICMPv6 network packet can pwn your Microsoft Windows machine"},"content":{"rendered":"

Patch Tuesday<\/strong> Microsoft’s Update Tuesday patch dump for October 2020 has delivered security patches that attempt to address 87 CVEs for a dozen Redmond products.<\/p>\n

Nadella’s security crew has identified 22 remote code execution (RCE) CVEs though the most worrisome looks like CVE-2020-16898, Windows TCP\/IP RCE<\/a>, which is rated 9.8 out 10 in severity. It affects Windows desktop and server systems.<\/p>\n

According to Microsoft, the Windows TCP\/IP stack doesn’t properly handle ICMPv6 Router Advertisement packets. Thus someone could send a vulnerable machine a maliciously crafted IPv6 packet over the network to inject and execute code on the box, and ultimately hijack it \u2013 presumably with kernel-level privileges. Here’s the worrying blurb from Redmond:<\/p>\n

Microsoft said exploitation is likely, and a workaround is available for Windows build 1709 and above. You’re urged to patch this ASAP, though.<\/p>\n

“Since the code execution occurs in the TCP\/IP stack, it is assumed the attacker could execute arbitrary code with elevated privileges,” said Zero Day Initiative’s Dustin Childs in a summary<\/a> of today’s patches.<\/p>\n

“If you\u2019re running an IPv6 network, you know that filtering router advertisements is not a practical workaround. Microsoft also gives this bug its highest exploitability rating, so exploits are likely. You should definitely test and deploy this patch as soon as possible.”<\/p>\n

CVE-2020-16947, a Microsoft Outlook RCE<\/a>, also looks like it could pose problems. Rated with a CVSS score of 8.1\/10, this memory handling flaw could allow an attacker to send a user with admin rights a specially crafted file and take over the system, if the preview pane is open.<\/p>\n

“The specific flaw exists within the parsing of HTML content in an email,” explained Childs. “The issue results from the lack of proper validation of the length of user-supplied data before copying it to a fixed-length heap-based buffer.”<\/p>\n

A total of 11 flaws are designated critical, 75 rate moderate, and one is merely important. Six of them have already been publicly disclosed.<\/p>\n

Affected applications include<\/a>:<\/p>\n