Zero-Day and Six Publicly Disclosed CVEs Fixed by Microsoft
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26701 +1 in the same advisory: …1721 | .NET Core Remote Code Execution Vulnerability .NET Core Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.1 group max | 30% |
| — | ||
| CVE-2021-1727 | Windows Installer Elevation of Privilege Vulnerability Windows Installer Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 group max | <1% |
| — | ||
| CVE-2021-1732 | Out-of-Bounds Write Local Privilege Escalation in Microsoft Win32k (CVE-2021-1732) CVE-2021-1732 is a local elevation-of-privilege vulnerability (CWE-787, out-of-bounds write) in Microsoft's Win32k kernel driver, publicly characterized as an "offset confusion" in the Win32k ConsoleControl routine. It is triggered locally: a process with only low privileges can invoke the vulnerable Win32k functionality without any user interaction, causing a user-supplied offset/pointer to be mishandled in kernel mode and memory to be written out of bounds. An attacker who successfully exploits the flaw can execute code in the kernel and elevate to SYSTEM, gaining full control of the host — which makes it a valuable second-stage link in malware and ransomware chains. Any system running the affected Windows 10 releases (1803, 1809, 1909, 2004, 20H2) or Windows Server 2019/1909/2004/20H2 is exposed, though exploitation requires the attacker to already run code locally on the target. The flaw was fixed in Microsoft's February 2021 Patch Tuesday updates, was added to CISA's KEV catalog on 2021-11-03 with known ransomware use, and carries a very high EPSS score (78.4%, 100th percentile), indicating sustained exploitation pressure. Do: Apply Microsoft's February 2021 (or later) Windows cumulative security updates to all affected Windows 10 and Windows Server systems, per vendor instructions — CISA's KEV listing requires federal agencies to patch. Prioritize hosts exposed to untrusted local users or already compromised by malware (e.g., ransomware or Raspberry Robin activity, which has used chained Windows LPEs), and hunt on unpatched hosts for signs of post-exploitation privilege escalation to SYSTEM. | 7.8 | 78% | KEV ransomware PoC ×2 |
| mass≈1 billion+ Windows devices (the listed builds spanned the mainstream Windows 10/Server install base) | |
| CVE-2021-1733 | Sysinternals PsExec Elevation of Privilege Vulnerability Sysinternals PsExec Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2021-24078 | Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 11% |
| — |
Full article411 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft has fixed 56 CVEs as part of this month’s Patch Tuesday, including several already publicly disclosed and one zero-day being actively exploited in the wild.
Although the workload is relatively light for sysadmins this month, there’s plenty to be concerned about.
The zero-day is CVE-2021-1732, a Windows Win32k.sys elevation of privilege vulnerability affecting Windows 10 and Windows Server 2019. Although rated as “important” rather than critical by Microsoft, its active exploitation should push it up to the top of the priority list.
Windows DNS Server remote code execution (RCE) vulnerability CVE-2021-24078 should be second on the to-do list, according to Recorded Future senior security architect, Allan Liska.
“This vulnerability impacts Windows Server 2008 through 2019. This is a critical vulnerability to which Microsoft has assigned a CVSS score of 9.8,” he added.
“Similar to SIGRed, which was disclosed last year, this vulnerability can be exploited remotely by getting a vulnerable DNS server to query for a domain it has not seen before — e.g. by sending a phishing email with a link to a new domain or even with images embedded that call out to a new domain.”
There are six additional CVEs in total for which proof-of-concept code or other information has been publicly released which could help attackers develop an exploit.
CVE-2021-1733 is a bug in Sysinternals PsExec which could allow an attacker to elevate their privileges. PSExec is commonly used in "living off the land" techniques for lateral movement.
Next come a couple of CVEs in .Net Core (RCE bug CVE-2021-26701) and .Net Core and Visual Studio (Denial of Service flaw CVE-2021-1721).
An information disclosure bug in DirectX (CVE-2021-24106) affects Windows 10 and Server 2016 and newer systems, while an elevation of privilege vulnerability in Windows Installer (CVE-2021-1727) impacts Windows 7 and Server 2008 and newer operating systems.
Finally, Microsoft fixed a DoS vulnerability in Windows Console Driver (CVE-2021-24098).
Ivanti senior director of product management, Chris Goettl, highlighted the importance of the .Net Core and PSExec fixes.
“As these development and IT tools do not follow the same update process as OS and application updates it is important to review your DevOps processes and determine if you are able to detect and respond to updates for common dev components,” he explained.
“For tools like PsExec it is important to understand your software inventory and where these tools are installed and ensure you can distribute updated versions as needed.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/zeroday-six-publicly-disclosed/