CVE-2020-1299
published 2020-06-09CVE-2020-1299: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who…
PriorityP356high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
14.54%
96.3th percentile
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'.
Affected
68 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Prioritize detection on workstation-type devices (email clients, browser-enabled systems, remote desktop servers) where .LNK file processing is most likely to be triggered. ↗
- →Alert on .LNK files accessed from remote drives or remote shares, as this is the documented attack vector for CVE-2020-1299. ↗
- ·Exploitation status at time of patch was 'Exploitation Less Likely' with no known public exploit or active in-the-wild exploitation reported. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
LNK Remote Code Execution Vulnerability
vendor_msrc·2020-06-09·CVSS 6.8
CVE-2020-1299 [HIGH] LNK Remote Code Execution Vulnerability
LNK Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.
An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
The attacker could present to the user a removable drive, or remote share, that contains a malicious .LNK file and an associated malicious binary. When the user opens this drive(or remote share) in Windows Explorer, or any other application that parses the .LNK file, the malicious binary will execute code of the attacker’s choice, on the target s
GHSA
GHSA-wx7p-w38c-jqv9: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a
ghsa_unreviewed·2022-05-24
CVE-2020-1299 [HIGH] GHSA-wx7p-w38c-jqv9: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'.
No detection rules found.
No public exploits indexed.
Securelist
IT threat evolution Q2 2020. PC statistics
blogs_securelist·2020-09-03
IT threat evolution Q2 2020. PC statistics
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by cybercriminals during cyberattacks
- Attacks on Apple macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- Victor Chebyshev
- Evgeny Lopatin
- Fedor Sinitsyn
- Denis Parinov
- Oleg Kupreev
- Alexey Kulaev
- Alexander Kolesnikov
IT threat evolution Q2 2020. Review
IT threat evolution Q2 2020. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q2:
- Kaspersky solutions blocked 899,744,810 attacks launched from online resources in 191 countries across the globe.
- As many as 286,
Securelist
IT threat evolution Q2 2020. PC statistics
blogs_securelist·2020-09-03
IT threat evolution Q2 2020. PC statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trend highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacks
Top 10 most common families of ransomware Trojans
Miners
Number of new modifications
Number of users attacked by miners
Geography of attacks
Vulnerable applications used by cybercriminals during cyberattacks
Attacks on Apple macOS
Threat geography
IoT attacks
IoT threat statistics
Threats loaded into traps
Attacks via web resources
Countries that are sources of web-based attacks: TOP 10
Countries where users faced the greatest risk of online infection
Local threats
Countries where users faced the highest risk of local infection
Authors
Victor
Trendmicro
Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
blogs_trendmicro·2020-06-10·CVSS 8.8
[HIGH] Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
Exploits & Vulnerabilities
## Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
By: Trend Micro 2020/06/10 Read time: ( words)
Save to Folio
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
While the update contained a significant number of patches, only 11 were rated Critical. One of the patches addresses yet another LNK-related vulnerability, CVE-2020-1299 , which att
Trendmicro
Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
blogs_trendmicro·2020-06-10·CVSS 8.8
[HIGH] Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
Sfruttamento vulnerabilità
## Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
By: Trend Micro Jun 10, 2020 Read time: ( words)
Save to Folio
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
While the update contained a significant number of patches, only 11 were rated Critical. One of the patches addresses yet another LNK-related vulnerability, CVE-2020-1299 , which a
Trendmicro
Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
blogs_trendmicro·2020-06-10·CVSS 8.8
[HIGH] Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
Exploits & Vulnerabilities
## Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
By: Trend Micro Jun 10, 2020 Read time: ( words)
Save to Folio
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
While the update contained a significant number of patches, only 11 were rated Critical. One of the patches addresses yet another LNK-related vulnerability, CVE-2020-1299 , which a
Trendmicro
Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
blogs_trendmicro·2020-06-10·CVSS 8.8
[HIGH] Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
Exploits & Vulnerabilities
# Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
By: Trend Micro
2020/06/10
Read time: ( words)
Save to Folio
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
While the update contained a significant number of patches, only 11 were rated Critical. One of the patches addresses yet another LNK-related vulnerability, CVE-2020-1299, which atta
Trendmicro
Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
blogs_trendmicro·2020-06-10·CVSS 8.8
[HIGH] Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
Exploits y vulnerabilidades
## Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
By: Trend Micro Jun 10, 2020 Read time: ( words)
Save to Folio
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
While the update contained a significant number of patches, only 11 were rated Critical. One of the patches addresses yet another LNK-related vulnerability, CVE-2020-1299 , which
Trendmicro
Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
blogs_trendmicro·2020-06-10·CVSS 8.8
[HIGH] Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
Ausnutzung von Schwachstellen
## Patch Tuesday: Fixes for LNK, SMB, and SharePoint Bugs
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
By: Trend Micro Jun 10, 2020 Read time: ( words)
Save to Folio
This month’s Patch Tuesday had the highest number of entries so far in 2020 — a whopping 129, a continuation of the trend seen from the previous months. The update includes fixes for LNK, SMB, SharePoint, and Win32k vulnerabilities.
While the update contained a significant number of patches, only 11 were rated Critical. One of the patches addresses yet another LNK-related vulnerability, CVE-2020-1299 , whic
Qualys
June 2020 Patch Tuesday – 128 Vulns, 11 Critical, Sharepoint, Workstation, Adobe Patches | Qualys
blogs_qualys·2020-06-09·CVSS 8.8
CVE-2020-1299 [HIGH] June 2020 Patch Tuesday – 128 Vulns, 11 Critical, Sharepoint, Workstation, Adobe Patches | Qualys
This month’s Microsoft Patch Tuesday addresses 128 vulnerabilities with 11 of them labeled as Critical. The 11 Critical vulnerabilities cover SharePoint server, Browsers, Scripting Engines, Windows, GDI+, OLE and LNK files. Adobe issued patches today for Experience Manager, Flash Player and Framemaker.
### Workstation Patches
The Browser, Scripting Engine, LNK files (CVE-2020-1299), GDI+(CVE-2020-1248) and OLE (CVE-2020-1281) should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
### SharePoint
A remote code execution vulnerability (CVE-2020-1181) is patched in Sharepoint Server that would allow an authenticated user on a guest sys
Qualys
June 2020 Patch Tuesday – 128 Vulns, 11 Critical, Sharepoint, Workstation, Adobe Patches
blogs_qualys·2020-06-09·CVSS 8.8
CVE-2020-1299 [HIGH] June 2020 Patch Tuesday – 128 Vulns, 11 Critical, Sharepoint, Workstation, Adobe Patches
This month’s Microsoft Patch Tuesday addresses 128 vulnerabilities with 11 of them labeled as Critical. The 11 Critical vulnerabilities cover SharePoint server, Browsers, Scripting Engines, Windows, GDI+, OLE and LNK files. Adobe issued patches today for Experience Manager, Flash Player and Framemaker.
## Workstation Patches
The Browser, Scripting Engine, LNK files ( CVE-2020-1299 ), GDI+( CVE-2020-1248 ) and OLE ( CVE-2020-1281 ) should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.
## SharePoint
A remote code execution vulnerability ( CVE-2020-1181 ) is patched in Sharepoint Server that would allow an authenticated user on a gue
2020-06-09
Published