Critical vulnerabilities in Microsoft Windows

The CryptoAPI vulnerability (CVE-2020-0601 External Link ) affects:

• Windows Server 2016, 2019
• Windows 10

The RDP server vulnerabilities (CVE-2020-0609 External Link and CVE-2020-0610 External Link ) affects:

• Windows Server 2012, 2016, 2019

The RDP client vulnerability (CVE-2020-0611 External Link ) affects:

• Windows Server 2008, 2012, 2016, 2019
• Windows 7, 8.1, 10

While it is normal for Microsoft to release monthly patches, the January 2020 release addresses critical vulnerabilities that are likely to be exploited by attackers, either individually or in combination.

With CVE-2020-0609 and CVE-2020-0610 attackers can execute arbitrary code on open RDP services, allowing full access to the machine.

With CVE-2020-0611 attackers can execute arbitrary code on a victim’s machine when the victim’s RDP client connects to their malicious RDP server.

With CVE-2020-0601 attackers can man-in-the-middle encrypted traffic that relies on the Windows CryptoAPI for certificate verification. It would also allow for the spoofing of valid code signatures, including driver software, which enables malicious software to appear to have been created by trusted sources.

Systems are vulnerable if they’re running an affected version of Windows, and have not had the January 2020 Windows updates applied.

Affected versions are:

• Windows Server 2008, 2012, 2016, 2019
• Windows 7, 8.1, 10

Ensure all vulnerable Windows systems on your network are patched with the January 2020 updates as soon as possible.

These patches should be considered urgent. If it’s difficult to apply them to all affected devices immediately, prioritise the devices that are:

• exposed to the internet – especially if running RDP
• used by administrators and high-privileged users, or
• used for business-sensitive purposes.