Microsoft March 2020 Security Updates

[Corrine]

The Microsoft March security updates have been released and consist of 115 CVEs. Of these 26 CVEs, rated Critical, 88 Important, and 1 rated Important in severity. None of the bugs being patched are listed as being publicly known or under active attack at the time of release.

The updates apply to the following:  Microsoft Windows, Microsoft Edge(EdgeHTML-based), Microsoft Edge (Chromium-based), ChakraCore, Internet Explorer, Microsoft Exchange Server, Microsoft Office and Microsoft Office Services and Web Apps, Azure DevOps, Windows Defender, Visual Studio, Open Source Software, Azure, and Microsoft Dynamics.

As of the time of this posting, Adobe has not released updates for Flash Player.

Recommended Reading:  See Dustin Childs review and analysis in Zero Day Initiative — The March 2020 Security Update Review.

March Security Updates Guide

[Digerati]

115 is a lot but I find it interesting and reassuring that none are publicly known or under active attack. While I don't know what all "active" implies, the fact none are publicly known suggests to me a pretty aggressive proactive approach by Microsoft to detect and fix bugs before they are discovered out in the wild. I see that as a very good thing.

[Corrine]

While I don't know what all "active" implies

Here is an example from the February security updates of an active attack:  CVE-2020-0674 | Scripting Engine Memory Corruption Vulnerability.  According to the analysis by Dustin Childs in Zero Day Initiative — The February 2020 Security Update Review,

Even if you don't use IE, you could still be affected by this bug though embedded objects in Office documents. Considering the listed workaround – disabling jscript.dll – breaks a fair amount of functionality, you should prioritize the testing and deployment of this patch.

[winchester73]

Here's Dustin's review for March:  https://www.zerodayinitiative.com/blog/2020/3/10/the-march-2020-security-update-review

[Digerati]

Here is an example from the February security updates of an active attack

Thanks for that but what I meant by not knowing what "all active implies" is I don't know "everything" being active does imply.

I get that it means it is not currently, at this point in time, under attack. But could that also mean it was under attack in the past, which would imply the vulnerability is known to the bad guys but they just aren't attacking right now - by choice?

Does it mean the vulnerability still exists? Or has it been patched? If not patched, do they expect it to be attacked in the coming days?

By saying "active" attack, it makes me wonder what all "inactive" attack means? Is it like a dormant volcano - as in one that isn't currently active or erupting but the volcanologist say it could tomorrow?

Nitpicking, I suppose. But when it comes to security, details matter. I don't like vagueness when not necessary.