Patch Tuesday, March 2020

Microsoft's monthly security release, Tuesday, March 10, 2020. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

2 CVEs · 1 critical · 2 exploited · 2 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← February 2020 April 2020 →Open in the dashboard

Microsoft

2 CVEs · 1 critical · 2 exploited · 2 with public exploit code

10.0CriticalMar 12, 2020Microsoft SMBv3 Memory corruptionCVE-2020-0796A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
7.8HighMar 12, 2020Microsoft Windows Privilege escalationCVE-2020-0787Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.Exploited43% likelyExploit codeMetasploit

Adobe

No tracked Adobe CVEs in this window.

SAP

1 CVE · 1 critical · 1 exploited · 1 with public exploit code

10.0CriticalMar 10, 2020SAP Solution Manager Auth bypass / access controlCVE-2020-6207SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.Exploited98% likelyExploit codeMetasploit · NucleiDetection

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.