May Patch Tuesday brings a bevy of SharePoint fixes

Most in IT will find their May patching workload, while still large in number, not as stressful as the previous month. However, SharePoint administrators will find a distressing number of patches available for the collaboration platform.

This month, Microsoft corrected 111 unique vulnerabilities with 16 rated critical. Last month, administrators faced three zero-days and 19 critical vulnerabilities among the 113 vulnerabilities. Most of the bugs identified in the May Patch Tuesday cluster around the usual suspects -- the Windows client and server operating systems and web browsers -- but administrators will want to also focus on SharePoint which gets a total of 12 bug fixes, including four rated critical.

Chris Goettl

The dramatic uptick in remote workers due to the COVID-19 pandemic has been met with a similar increase in attacks that target these users to find a foothold into an organization's network. It's possible the sudden growth of employees working from home correlates with the sizeable number of SharePoint vulnerabilities corrected this month.

"SharePoint has become a foundation of what drives the Office platform," said Chris Goettl, director of product management and security at Ivanti, a security and IT management vendor based in South Jordan, Utah. "It definitely has increased in popularity and, with that, I would expect that threat actors are going to spend a little bit more attention on it because it's a means for them to get in and try one more way to do that." 

Zoom obviously had the biggest explosion in popularity, but Microsoft Teams was arguably second in line. One of the things that comes with Teams is the ability to share files collaboratively in meeting sessions or chats or team groups. All that is driven by SharePoint.

Four of the critical vulnerabilities (CVE-2020-1023, CVE-2020-1024, CVE-2020-1069 and CVE-2020-1102) in SharePoint would give remote-code execution abilities to an attacker, who could then move throughout the network and perform a range of actions, such as access sensitive information in databases, run malicious code or find a way to embed their position. The remaining eight vulnerabilities, rated important, correct spoofing and information disclosure problems.

The unexpected shift to a remote-work setting for many workers coincided with a speedy distribution of laptops that might have sacrificed security for the sake of efficiency, leaving endpoints -- as well as every connected device on the company network -- at risk.

"Zoom obviously had the biggest explosion in popularity, but Microsoft Teams was arguably second in line. One of the things that comes with Teams is the ability to share files collaboratively in meeting sessions or chats or team groups. All that is driven by SharePoint," Goettl said.  

In addition to SharePoint, Windows and web browsers, May Patch Tuesday security updates also corrected issues with the ChakraCore JavaScript engine, Microsoft Office and Office Services and Web Apps, Windows Defender, Visual Studio, Microsoft Dynamics, .NET Framework, .NET Core and Power BI products.

The relatively low number of critical vulnerabilities should not minimize the urgency to roll out the updates as quickly as possible. Goettl noted that 10 of the 111 CVEs for May Patch Tuesday have a "1 - Exploitation More Likely" rating in Microsoft's exploitability index, which assigns a 0-3 rating based on analysis the company attaches to each CVE. A vulnerability with the "0 - Exploitation Detected" rating means there are reports of exploits for the flaw, while bugs marked with "3 - Exploitation Unlikely" indicate the slim likelihood of an attacker creating an exploit.

 Out of the 10 CVEs rated "Exploitation More Likely" for May Patch Tuesday, seven have a severity level of important which should give some organizations pause when they determine their patch deployment priorities.

"If you look just at vendor severity, many of the zero-days that we've seen over the past couple of years were actually only rated as important. And that's on the day that Microsoft said it knew the CVE was actively exploited, so a lot of times you can't take severity as the only indicator," Goettl said.