Microsoft Patches Multiple Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33781 | Azure AD Security Feature Bypass Vulnerability Azure AD Security Feature Bypass Vulnerability NVD description · AI analysis pending | 8.1 | 2% |
| — | ||
| CVE-2021-40449 | Use-After-Free Local Privilege Escalation in Microsoft Windows Win32k Microsoft's Win32k kernel driver contains a use-after-free (CWE-416) local privilege escalation vulnerability (CVE-2021-40449) affecting Windows client versions from Windows 7 through Windows 11 21H2. A local attacker who can already execute code on a system can trigger the flaw — demonstrated in a public proof of concept via the NtGdiResetDC system call — to corrupt kernel memory and elevate to SYSTEM-level privileges with high impact on confidentiality, integrity, and availability (CVSS 7.8, local vector, no user interaction). Any Windows desktop or laptop running the affected versions is exposed to any unprivileged process or malware that gains a foothold on the device. The bug was exploited as a zero-day in the wild before being fixed; CISA added it to the KEV catalog on 2021-11-17 with known ransomware use, and public reporting ties exploitation to the MysterySnail RAT campaign (including the lightweight MysteryMonoSnail backdoor). EPSS places the flaw in the 99th percentile, with a 74.1% probability of exploitation activity within 30 days. Do: Apply Microsoft's security updates addressing this Win32k flaw via Windows Update on all affected Windows 7, 8.1, 10, and 11 clients, per the CISA KEV required action, and verify inventories show no unpatched Windows 10 builds (1507–21H1) or Windows 11 21H2 endpoints. Because this was a zero-day exploited in the wild — including in campaigns involving MysterySnail and ransomware use noted by CISA — treat patching as urgent on all endpoints. Until patched, limit execution of untrusted or unprivileged local code on these systems. | 7.8 | 74% | KEV ransomware PoC |
| mass≈1 billion+ Windows client devices (effectively the entire Windows 7 through Windows 11 installed base at the time of disclosure) | |
| CVE-2021-40469 | Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.2 | 8% |
| — | ||
| CVE-2021-41335 +1 in the same advisory: …41338 | Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 group max | 1% |
| — |
Full article302 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft fixed 74 new CVEs yesterday, including several zero-day vulnerabilities, one of which is being actively exploited in the wild.
Zero-day bug CVE-2021-40449 is a Win32k elevation of privilege vulnerability in Windows affecting Windows 7 and Server 2008 up to Windows 11 and Server 2022. It has reportedly been exploited by Chinese threat actors known as “IronHusky.”
“Microsoft only rated the vulnerability as “important” by their severity scoring system, which is a good example of why organizations need to focus on vulnerability remediation based on risk,” argued Ivanti senior director of product management, Chris Goettl.
“A risk-based approach to vulnerability management takes into account more real-world indicators such as known exploited, public disclosure, and usage trends by threat actors to better understand what exposures you should be focusing on first.”
Microsoft also fixed three publicly disclosed (zero-day) flaws which have had proof-of-concept code released, giving attackers a head-start in crafting exploits for them.
These are CVE-2021-41338, a security feature bypass vulnerability in Windows AppContainer Firewall; Windows kernel elevation of privilege bug CVE-2021-41335; and Windows DNS remote code execution vulnerability CVE-2021-40469.
There was also an updated fix for CVE-2021-33781, a security feature bypass flaw in Azure AD. This vulnerability was initially resolved in the July Patch Tuesday but has been updated to fix Windows 10 v1607, Server 2016 and Windows 11.
Elsewhere, Adobe updated Acrobat, Reader, Connect, Reader Mobile, Commerce, Campaign Standard and ops-cli.
“The updates for Adobe Connect (APSB21-91) and ops-cli (APSB21-88) include critical CVEs with a CVSS base score of 9.8 out of 10,” explained Goettl.
“Adobe Acrobat and Reader (APSB21-104) resolves the most CVEs out of the line-up. A total of four CVEs, two of which are rated as Critical with CVSS scores of 7.8 were resolved in this update.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-patches-multiple-zeroday/