• Krebs: This month’s code signing zeroday, CVE-2020-1464, has been around for two years

    Posted on August 17, 2020 at 07:52 CDT by • Comment in the Forums

    This month we had two zero-days fixed in the Patch Tuesday crop. Several folks in the press screamed that the sky is falling and you have to get patched right now.

    Seems that the truth is a bit more prosaic. As truth frequently is.

    First we discovered that one of the zero-days, CVE-2020-1380, relies on Internet Explorer and it’s been used on an undisclosed South Korean company, in conjunction with other security holes. By itself, this zero-day doesn’t mean much.

    Now comes word from Brian Krebs that the other zero-day, CVE-2020-1464, was reported to Microsoft two years ago. It’s not exactly front-burner stuff:

    Asked to comment on why it waited two years to patch a flaw that was actively being exploited to compromise the security of Windows computers, Microsoft dodged the question, saying Windows users who have applied the latest security updates are protected from this attack.

    Moral of the story: It’s very, very rare that you need to patch immediately. Wait and see what problems crop up before you install the latest fare from Microsoft.

    Windows Patches/Security
DON'T MISS OUT!
Subscribe to the Free Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

View the Forum

  • Recent Replies
  • My Replies
  • My Active Topics
  • New Posts in the Last day
  • Private Messages
  • Knowledge Base
  • How to use the Forums
  • All Forums

    • Recent Topics

    My Profile

    May 2025
    S M T W T F S
     123
    45678910
    11121314151617
    18192021222324
    25262728293031

    Remembering Woody

     

    Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.

    Mastodon profile for DefConPatch
    Mastodon profile for AskWoody

     

    Home • About • FAQ • Posts & Privacy • Forums • My Account
    Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts

    Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.