Patch three critical Windows vulnerabilities (CVE-2020-0601, CVE-2020-0609 & CVE-2020-0610) immediately to prevent potential cyber attack

Attack

Mode

• The attacker can connect to the targeted system using RDP and send specially crafted requests to exploit the vulnerability. As it is pre-authentication and requires no user interaction, the victim would not sense any suspicious activities during the intrusion.

• The attacker can conduct a wide range of attacks to undermine the cryptographic trust such as:
  
  (a) Spoofing a code-signing digital certificate to sign a malicious executable, making a file or an email appearing as from a trusted and legitimate source. This could deceive users or thwart the protection from anti-malware software installed;
  
  (b) Spoofing the sender identity by signing a forged email to deceive users of the integrity of the email message; and
  
  (c) Spoofing an HTTP connection via man-in-the-middle attack to decrypt the user’s sensitive data in transmission.

Affected

Products

• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019

• Microsoft Windows 10
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server, version 1803
• Microsoft Windows Server, version 1903
• Microsoft Windows Server, version 1909