Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities

Windows WLAN AutoConfig Service Remote Code Execution Vulnerability

CVE-2021-36955 is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) driver, the kernel component responsible for managing log files used by various Windows features. An attacker who can already run code locally with limited user privileges can trigger the flaw in the CLFS driver and escalate to SYSTEM without any user interaction (CVSS 3.1: 7.8, local vector, low privileges required). Successful exploitation grants full SYSTEM-level control of the host, which adversaries use to disable security tooling and chain with other exploits during ransomware operations. The affected footprint is broad: Windows 7, 8.1, RT 8.1, Windows 10 builds 1507 through 21H1, and Windows Server 2004 and 2008 as listed in CISA's data. The flaw is confirmed exploited in the wild and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use; no standalone public proof-of-concept is known.

Do: Apply the Microsoft Windows security updates that fix this flaw across all affected versions immediately, per the CISA KEV required action (the fix was shipped in Microsoft's monthly Patch Tuesday updates, including the September 2021 release). Prioritize hosts where untrusted users can log on locally or via RDP, since this is a local privilege escalation used to reach SYSTEM in ransomware chains. Verify remediation with vulnerability scans and confirm your assets are cleared against the CISA KEV catalog.

Azure Sphere Information Disclosure Vulnerability

CVE-2021-38647 is an unauthenticated remote code execution flaw (CWE-1390, missing authentication) in Microsoft's Open Management Infrastructure (OMI), the open-source Linux management agent Microsoft bundles into Azure VM management extensions and System Center Operations Manager (SCOM) agents. When OMI is deployed through these extensions (for example the Log Analytics/OMS agent, Azure Monitor, or Azure Automation), its root-privileged server component listens for management traffic on the network (by default ports 5985/5986), and an attacker who can reach that port can send specially crafted, unauthenticated management requests that execute commands as root. Successful exploitation gives an attacker full root-level control of the affected Linux VM, turning network reachability into complete host compromise and a foothold for lateral movement. Any Azure Linux VM with an OMI-based management extension, plus standalone OMI or SCOM-agent deployments on Linux, is affected; CISA added the bug to the KEV on 2021-11-03 with known ransomware use, so exploitation is confirmed in the wild even though no public proof-of-concept is catalogued, and EPSS estimates a ~99.9% near-term exploitation probability.

Do: Upgrade OMI to version 1.6.8-1 or later on all Linux VMs, including updating the bundled OMI inside Azure management extensions (Log Analytics/OMS agent, Azure Monitor, Azure Automation) and applying patched SCOM agent builds. Restrict network access to OMI's listener ports (5985/5986) with NSGs or host firewalls and check whether omiserver runs as root while binding beyond localhost. Because the flaw is in CISA KEV with known ransomware use, prioritize patching hosts whose OMI listener is reachable from untrusted networks and hunt for unexplained root-level activity.

CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021.

Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file.