Microsoft Patch Tuesday for Feb. 2021 — Snort rules and prominent vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1732 | Out-of-Bounds Write Local Privilege Escalation in Microsoft Win32k (CVE-2021-1732) CVE-2021-1732 is a local elevation-of-privilege vulnerability (CWE-787, out-of-bounds write) in Microsoft's Win32k kernel driver, publicly characterized as an "offset confusion" in the Win32k ConsoleControl routine. It is triggered locally: a process with only low privileges can invoke the vulnerable Win32k functionality without any user interaction, causing a user-supplied offset/pointer to be mishandled in kernel mode and memory to be written out of bounds. An attacker who successfully exploits the flaw can execute code in the kernel and elevate to SYSTEM, gaining full control of the host — which makes it a valuable second-stage link in malware and ransomware chains. Any system running the affected Windows 10 releases (1803, 1809, 1909, 2004, 20H2) or Windows Server 2019/1909/2004/20H2 is exposed, though exploitation requires the attacker to already run code locally on the target. The flaw was fixed in Microsoft's February 2021 Patch Tuesday updates, was added to CISA's KEV catalog on 2021-11-03 with known ransomware use, and carries a very high EPSS score (78.4%, 100th percentile), indicating sustained exploitation pressure. Do: Apply Microsoft's February 2021 (or later) Windows cumulative security updates to all affected Windows 10 and Windows Server systems, per vendor instructions — CISA's KEV listing requires federal agencies to patch. Prioritize hosts exposed to untrusted local users or already compromised by malware (e.g., ransomware or Raspberry Robin activity, which has used chained Windows LPEs), and hunt on unpatched hosts for signs of post-exploitation privilege escalation to SYSTEM. | 7.8 | 78% | KEV ransomware PoC ×2 |
| mass≈1 billion+ Windows devices (the listed builds spanned the mainstream Windows 10/Server install base) | |
| CVE-2021-24072 | Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 2% |
| — | ||
| CVE-2021-24074 +1 in the same advisory: …24094 | Windows TCP/IP Remote Code Execution Vulnerability Windows TCP/IP Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 26% |
| — |
Full article431 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, February 9, 2021 14:17
By Jon Munshaw, with contributions from Bill Largent.
Microsoft released its monthly security update Tuesday, disclosing 56 vulnerabilities across its suite of products. This is the smallest amount of vulnerabilities Microsoft has disclosed in a month since January 2020.
There are only 11 critical vulnerabilities as part of this release, while there are three moderate-severity exploits, and the remainder are considered “important.” Users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation of all these bugs.
The security updates cover several different products and services, including the Microsoft Office suite of products, the Windows DNS server and the SharePoint file-sharing service.
Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For complete details, check out the latest Snort advisory here.
Two of the critical vulnerabilities exist in Windows’ TCP/IP settings. CVE-2021-24074 and CVE-2021-24094 could allow an adversary to execute arbitrary code on the victim machine. Both have a CVSS severity score of 8.1 out of 10. While Microsoft made a patch available to fix these vulnerabilities, there are also multiple workarounds to protect users the company outlined in its advisory.
Another critical vulnerability subsists in SharePoint with a CVSS score of 8.8 out of 10. CVE-2021-24072 requires no user interaction, allowing an adversary to exploit the software in a way that would allow them to execute remote code on the targeted machine.
It’s also worth highlighting CVE-2021-1732, a privilege escalation vulnerability in the Win32k program. While Microsoft only lists this vulnerability as being “important,” the company did note that this vulnerability has been spotted being exploited in the wild, though it has not been publicly reported. This exploit affects multiple versions of Windows 10, along with some versions of Windows Server 2019.
For a complete list of all the vulnerabilities Microsoft disclosed this month, check out its update page.
In response to these vulnerability disclosures, Talos is releasing a new SNORTⓇ rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
The rules included in this release that protect against the exploitation of many of these vulnerabilities are 57103, 57104, 57106 - 57108, 57123 and 57128.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-feb-2021/