Microsoft Patch Tuesday Updates Fixes Exploited Zero Day

Summary

Threat actors are targeting Windows systems using a combination of two zero-day vulnerabilities, one affecting Google Chrome (CVE-2020-15999) and the other affecting Windows 7 through 10 (CVE-2020-17087). Successful exploitation of the flaws could allow threat actors to run malicious code inside Chrome and escape its secure container to run code on the underlying operating system. Google released a patch to fix the Chrome flaw on October 20, 2020 and Microsoft patched the Windows flaw in their November Patch Tuesday updates.

Recommendations

The NJCCIC recommends users and administrators prioritize applying updates to both Chrome and Windows as these vulnerabilities are currently being exploited in the wild and proof of concept code is public. More details on the Windows vulnerability and exploitation of these flaws by threat actors can be found in the Microsoft Security Advisory and Chromium blog post, respectively.