Microsoft has released the October 2020 Office security updates with a total of 24 security updates and 5 cumulative updates for 7 different products, fixing 13 vulnerabilities that could enable remote attackers to execute arbitrary code on vulnerable systems.
The highlight of this month’s Microsoft Office security updates is without a doubt CVE-2020-16947, a remote code execution vulnerability that leads to remote code execution when previewing or opening maliciously crafted emails with a vulnerable Microsoft Outlook version.
Exploitation can also be achieved in a web-based attack scenario via sites used to host specially crafted files designed to exploit CVE-2020-16947.
When successfully exploited, the bug allows attackers to run arbitrary code in the context of the System user. The attackers could also take over the targeted system if the currently logged on user has administrative user rights.
CVE-2020-16947 affects several Office products including Microsoft Outlook 2016 and Microsoft Office 2019, as well as Microsoft 365 Apps for Enterprise.
Also Read: What Is A Governance Framework? The Importance And How It Works
The October 2020 Patch Tuesday Office security updates address remote code execution (RCE), security bypass, elevation of privilege, denial of service, information disclosure, and cross-site scripting vulnerabilities on Windows systems running vulnerable Microsoft Installer (.msi) and Click to Run editions of Microsoft Office products.
Microsoft rated the 11 RCE security flaws patched this month Critical or Important severity issues seeing that they could enable attackers to execute arbitrary code in the context of the current user after successful exploitation.
The attackers could then install malicious programs, view, change, and delete data, as well as create their own rogue admin accounts on compromised Windows devices.
| Tag | CVE ID | Title | Severity |
| Microsoft Office | CVE-2020-16933 | Microsoft Word Security Feature Bypass Vulnerability | Important |
| Microsoft Office | CVE-2020-16929 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16934 | Microsoft Office Click-to-Run Elevation of Privilege Vulnerability | Important |
| Microsoft Office | CVE-2020-16932 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16930 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16955 | Microsoft Office Click-to-Run Elevation of Privilege Vulnerability | Important |
| Microsoft Office | CVE-2020-16928 | Microsoft Office Click-to-Run Elevation of Privilege Vulnerability | Important |
| Microsoft Office | CVE-2020-16957 | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16918 | Base3D Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16949 | Microsoft Outlook Denial of Service Vulnerability | Moderate |
| Microsoft Office | CVE-2020-16947 | Microsoft Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2020-16931 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-16954 | Microsoft Office Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2020-17003 | Base3D Remote Code Execution Vulnerability | Critical |
| Microsoft Office SharePoint | CVE-2020-16948 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16953 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16942 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16951 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office SharePoint | CVE-2020-16944 | Microsoft SharePoint Reflective XSS Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16945 | Microsoft Office SharePoint XSS Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16946 | Microsoft Office SharePoint XSS Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16941 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16950 | Microsoft SharePoint Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2020-16952 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical |
This month’s Microsoft Office security updates are delivered via the Microsoft Update platform and through the Download Center.
To download October 2020 Microsoft Office security updates, click on their corresponding knowledge base article below and then scroll down to the ‘How to download and install the update‘ section to grab the updates for your Office product.
Also Read: Computer Misuse Act Singapore: The Truth And Its Offenses
More information including CVE IDs is available within the knowledge base articles linked below.
| Product | Knowledge Base article |
|---|---|
| Excel 2016 | Security update for Excel 2016 (KB4486678) |
| Office 2016 | Security update for Office 2016 (KB4486682) |
| Office 2016 | Security update for Office 2016 (KB4484417) |
| Outlook 2016 | Security update for Outlook 2016 (KB4486671) |
| Word 2016 | Security update for Word 2016 (KB4486679) |
| Product | Knowledge Base article |
|---|---|
| Excel 2013 | Security update for Excel 2013 (KB4486695) |
| Office 2013 | Security update for Office 2013 (KB4486688) |
| Office 2013 | Security update for Office 2013 (KB4484435) |
| Outlook 2013 | Security update for Outlook 2013 (KB4484524) |
| Word 2013 | Security update for Word 2013 (KB4486692) |
| Product | Knowledge Base article |
|---|---|
| Excel 2010 | Security update for Excel 2010 (KB4486707) |
| Office 2010 | Security update for Office 2010 (KB4486700) |
| Office 2010 | Security update for Office 2010 (KB4486701) |
| Outlook 2010 | Security update for Outlook 2010 (KB4486663) |
| Word 2010 | Security update for Word 2010 (KB4486703) |
| Product | Knowledge Base article |
|---|---|
| Office Online Server | Security update for Office Online Server (KB4486674) |
| SharePoint Server 2019 | Security update for SharePoint Server 2019 (KB4486676) |
| Product | Knowledge Base article |
|---|---|
| SharePoint Enterprise Server 2016 | Security update for SharePoint Enterprise Server 2016 (KB4486677) |
| Product | Knowledge Base article |
|---|---|
| Office Web Apps Server 2013 | Security update for Office Web Apps Server 2013 (KB4486689) |
| Project Server 2013 | Cumulative update for Project Server 2013 (KB4486691) |
| SharePoint Enterprise Server 2013 | Security update for SharePoint Enterprise Server 2013 (KB4486687) |
| SharePoint Enterprise Server 2013 | Cumulative update for SharePoint Enterprise Server 2013 (KB4486693) |
| SharePoint Foundation 2013 | Security update for SharePoint Foundation 2013 (KB4486694) |
| SharePoint Foundation 2013 | Cumulative update for SharePoint Foundation 2013 (KB4486690) |
| Product | Knowledge Base article |
|---|---|
| Project Server 2010 | Cumulative update for Project Server 2010 (KB4486702) |
| SharePoint Foundation 2010 | Security update for SharePoint Foundation 2010 (KB4486708) |
| SharePoint Server 2010 | Security update for SharePoint Server 2010 (KB4484531) |
| SharePoint Server 2010 | Cumulative update for SharePoint Server 2010 (KB4486705) |
| SharePoint Server 2010 Excel Web App | Security update for SharePoint Server 2010 Excel Web App (KB4462175) |
Yesterday, Redmond also released the October 2020 Patch Tuesday security updates with security updates for 87 vulnerabilities, 12 of them being rated as Critical, 74 as Important, and one as moderate.
Non-security Windows updates with fixes and improvements were also issued yesterday with the Windows 10 KB4579311 & KB4577671 Cumulative Updates.
As part of this month’s Patch Tuesday, Microsoft also addressed a critical vulnerability in the Windows TCP/IP stack tracked as CVE-2020-16898 and dubbed ‘Bad Neighbor’.
US Cyber Command warned Microsoft customers to immediately patch the Bad Neighbor bug known to affect multiple client (Windows 10) and server (Windows Server) platforms.
Established in 2018, Privacy Ninja is a Singapore-based IT security company specialising in data protection and cybersecurity solutions for businesses. We offer services like vulnerability assessments, penetration testing, and outsourced Data Protection Officer support, helping organisations comply with regulations and safeguard their data.
Singapore
7 Temasek Boulevard,
#12-07, Suntec Tower One,
Singapore 038987
