Microsoft's March Patch Tuesday fixes 14 Critical flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26411 | Use-After-Free Memory Corruption in Microsoft Internet Explorer Exploited in the Wild CVE-2021-26411 is a use-after-free (CWE-416) memory corruption vulnerability in Microsoft Internet Explorer's web rendering engine that can lead to remote code execution. It is triggered when a user, typically lured via a link, email, or watering-hole page, views attacker-controlled web content that corrupts memory, consistent with the CVSS profile requiring network access and user interaction. A successful attacker gains code execution in the context of the logged-on user, which in observed campaigns was chained into malware delivery (including exploit-kit payloads such as Dridex and VBA-based malware). Any Windows system that renders web content with Internet Explorer or its IE/MSHTML components (Edge is also listed among affected CPE products) is potentially affected, though specific version ranges are not provided in the source data. The flaw was exploited as a zero-day around Microsoft's March 2021 Patch Tuesday, was added to CISA KEV on 2021-11-03 with known ransomware use, and carries an 80.8% EPSS probability of exploitation within 30 days. Do: Apply Microsoft's March 2021 cumulative security updates for Internet Explorer, or any later cumulative update, across all Windows clients and servers, prioritizing user workstations per the CISA KEV required action. Review proxy and endpoint logs for visits to compromised watering-hole sites (notably Korean-language news sites) and for follow-on malware such as Dridex, and restrict or disable IE/legacy IE-mode rendering of untrusted web content where feasible. | 8.8 | 81% | KEV ransomware |
| mass≈hundreds of millions of Windows endpoints (IE/MSHTML components are present on effectively all supported Windows clients and servers) | |
| CVE-2021-26897 | Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 12% |
| — | ||
| CVE-2021-27080 +1 in the same advisory: …27074 | Azure Sphere Unsigned Code Execution Vulnerability Azure Sphere Unsigned Code Execution Vulnerability NVD description · AI analysis pending | 9.3 group max | 1% | PoC |
| — | |
| CVE-2021-27076 | Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 14% |
| — |
Full article412 words · extracted from securityaffairs.com · click to collapse
Microsoft’s March Patch Tuesday security updates address 89 vulnerabilities in its products, 14 are listed as Critical and 75 are listed as Important in severity.
Microsoft’s March Patch Tuesday security updates address 89 vulnerabilities in its products, including Microsoft Windows components, Azure and Azure DevOps, Azure Sphere, Internet Explorer and Edge (EdgeHTML), Exchange Server, Office and Office Services and Web Apps, SharePoint Server, Visual Studio, and Windows Hyper-V.
The list of CVEs covered by the security updates includes seven vulnerabilities in Microsoft Exchange recently addressed by Microsoft with the release of out-of-band fixes. 14 of the vulnerabilities fixed with the release of Microsoft’s March Patch Tuesday are listed as Critical and 75 are listed as Important in severity. Two of these vulnerabilities are publicly known and five were actively exploited in attacks in the wild at the time of release.
One of the most severe flaws addressed with the release of Microsoft’s March Patch Tuesday is an Internet Explorer memory corruption bug tracked as CVE-2021-26411. The flaw could allow attackers to run arbitrary code on affected systems, at the level of the logged-on user, by tricking victims into viewing a specially crafted HTML file.
“CVE-2021-26411 – Internet Explorer Memory Corruption Vulnerability
This patch corrects a bug in Internet Explorer (IE) and Edge (EdgeHTML-based) that could allow an attacker to run their code on affected systems if they view a specially crafted HTML file.” reads the post published by Zero Day Initiative.
“Microsoft lists this as both publicly known and under active attack at the time of release. While not as impactful as the Exchange bugs, enterprises that rely on Microsoft browsers should definitely roll this out quickly. Successful exploitation would yield code execution at the level of the logged-on user, which is another reminder not to browse web pages using an account with Administrative privileges.”
The vulnerability received a CVSS score of 8.8.
Another critical issue addressed by Microsoft, tracked as CVE-2021-26897, is a Windows DNS Server Remote Code Execution vulnerability. The vulnerability received a CVSS score of 9.8.
Other interesting critical issues fixed by Microsoft are CVE-2021-27074 and CVE-2021-27080, unsigned code execution bugs in Azure Sphere, and CVE-2021-27076 Server Remote Code Execution vulnerability in Microsoft SharePoint.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Microsoft’s March Patch Tuesday)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/115439/security/microsofts-march-patch-tuesday-21.html