Microsoft Patch Tuesday security updates for November 2021 fix 2 Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-38631 +1 in the same advisory: …41371 | Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability NVD description · AI analysis pending | 4.4 | 2% |
| — | ||
| CVE-2021-42321 | Authenticated RCE via Insecure Deserialization in Microsoft Exchange Server CVE-2021-42321 is an insecure deserialization remote code execution flaw in on-premises Microsoft Exchange Server, tied to insufficient validation by Exchange's ChainedSerializationBinder. Per the CVSS vector, it is triggered over the network by an authenticated user with low privileges and no user interaction, by submitting crafted serialized data that Exchange fails to safely deserialize. A successful attacker gains arbitrary code execution on the Exchange server with high impact to confidentiality, integrity, and availability, giving a foothold in the mail environment. Organizations running affected on-premises Exchange deployments are in scope. The flaw was actively exploited before patches shipped in November 2021, has public PoC exploits, was added to CISA's KEV on 2021-11-17 with known ransomware use, and carries an EPSS of 91.7% (99.9+ percentile). Do: Apply the November 2021 Microsoft Exchange Server security updates per vendor instructions to affected on-premises Exchange 2016/2019 deployments. Given confirmed in-the-wild exploitation and known ransomware use, check Exchange servers for signs of compromise, verify backups, and review accounts holding privileged Exchange roles, since exploitation requires authenticated access — enforce MFA and audit impersonation/admin role assignments while patching. | 8.8 | 92% | KEV ransomware PoC ×2 |
| masshundreds of thousands of internet-facing on-premises Exchange servers (on the order of 10^5 endpoints, supporting millions of mailbox users) | |
| CVE-2021-43209 +1 in the same advisory: …43208 | 3D Viewer Remote Code Execution Vulnerability 3D Viewer Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 7% |
| — |
Full article435 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 09, 2021
Microsoft Patch Tuesday security updates for November 2021 address 55 vulnerabilities in multiple products and warn of two actively exploited issues.
Microsoft Patch Tuesday security updates for November 2021 addressed a total of 55 vulnerabilities in Microsoft Windows and Windows Components, Azure, Azure RTOS, Azure Sphere, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Microsoft Office and Office Components, Windows Hyper-V, Windows Defender, and Visual Studio.
The IT giant also confirmed that two vulnerabilities in Microsoft Exchange Server and Microsoft Excel are actively exploited.
“We are aware of limited targeted attacks in the wild using one of vulnerabilities (CVE-2021-42321), which is a post-authentication vulnerability in Exchange 2016 and 2019. Our recommendation is to install these updates immediately to protect your environment.” read the announcement published by Microsoft. “These vulnerabilities affect on-premises Microsoft Exchange Server, including servers used by customers in Exchange Hybrid mode. Exchange Online customers are already protected and do not need to take any action.”
Six of the issues fixed by Microsoft are rated Critical and 49 are rated as Important in severity. Four of these vulnerabilities have been reported through the ZDI program.
“Historically speaking, 55 patches in November is a relatively low number. Last year, there were more than double this number of CVEs fixed. Even going back to 2018 when there were only 691 CVEs fixed all year, there were more November CVEs fixed than in this month.” reads the post published by Zero Day Initiative.
The actively exploited vulnerabilities addressed by Microsoft this month are:
CVE-2021-42321 – Microsoft Exchange Server Remote Code Execution Vulnerability – The flaw is a remote code execution issue that occurs due to improper validation of cmdlet arguments. Microsoft pointed out that the flaw can be exploited only by an authenticated attacker.
CVE-2021-42292 – Microsoft Excel Security Feature Bypass Vulnerability – This vulnerability is a code execution issue that can be triggered by an attacker tricking the victims into opening a specially crafted file with an affected version of Excel. The flaw affects Microsoft Office for macOS but the company has yet to fix the issue for Apple’s platform.
Microsoft also addressed four other publicly disclosed vulnerabilities:
- CVE-2021-38631 – Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2021-41371 – Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2021-43208 – 3D Viewer Remote Code Execution Vulnerability
- CVE-2021-43209 – 3D Viewer Remote Code Execution Vulnerability
The complete list of vulnerabilities addressed this month is available here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Operation Cyclone)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/124405/security/microsoft-patch-tuesday-november-2021.html