Microsoft patches actively exploited zero-day (CVE-2021-36948), more Print Spooler flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-36947 | Windows Print Spooler Remote Code Execution Vulnerability Windows Print Spooler Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 group max | 7% |
| — | ||
| CVE-2021-34535 | Remote Desktop Client Remote Code Execution Vulnerability Remote Desktop Client Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 22% |
| — | ||
| CVE-2021-36942 +1 in the same advisory: …36948 | Unauthenticated LSA Spoofing (PetitPotam NTLM Relay) in Microsoft Windows CVE-2021-36942 is a spoofing flaw in the Windows Local Security Authority (LSA), widely known as "PetitPotam," that lets an unauthenticated network attacker trick a Windows host into authenticating with NTLM to a machine the attacker controls. It is triggered remotely with no privileges and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) by sending crafted requests that coerce the target system to authenticate. By relaying that coerced authentication to other services, an attacker can impersonate the machine — most critically a domain controller — and escalate toward domain-administrator access, producing a high confidentiality impact. All listed Windows Server releases are affected, with domain controllers and certificate-services servers as the highest-value targets. The flaw is actively exploited in the wild: it was added to CISA's KEV on 2021-11-03 with known ransomware use (LockFile and Babuk campaigns chained it with Exchange flaws), and Microsoft has released Windows updates to address it. Do: Apply Microsoft's Windows updates per vendor instructions, prioritizing domain controllers and servers running Active Directory Certificate Services. As interim hardening, require SMB signing and restrict NTLM authentication per Microsoft guidance, and review authentication logs for unexpected NTLM connections from domain controllers to certificate-services endpoints. | 7.5 group max | 66% | KEV ransomware PoC |
| massmillions of Windows Server deployments; hundreds of thousands of SMB-exposed hosts in public internet scans |
Full article461 words · extracted from helpnetsecurity.com · click to collapse
Microsoft’s August 2021 Patch Tuesday is pretty lightweight, through it covers a wide variety of Microsoft solutions. 44 CVE-numbered security holes have been plugged, seven of which are critical, and one is actively exploited (CVE-2021-36948).
Fixed vulnerabilities of note
Let’s start with the zero-day. CVE-2021-36948 is a vulnerability in the Windows Update Medic Service that can be exploited by attackers to escalate privileges on a compromised system (and misuse them to do things like create user accounts, delete their tracks, and so on). It affects various versions of Windows 10 and Windows Server.
Microsoft says that its security research teams spotted it being actively exploited, though they did not share details about the attack(s).
The company has fixed three Windows Print Spooler bugs: one “critical”
(CVE-2021-36936) and two “important” (CVE-2021-34483, CVE-2021-36947).
“CVE-2021-36947 and CVE-2021-36936 are rated as “Exploitation More Likely,” according to Microsoft’s Exploitability Index. CVE-2021-36936 is also identified as being publicly disclosed, which implies this is one of the additional vulnerabilities researchers have uncovered since PrintNightmare was first disclosed. Because of the ubiquitous nature of the Windows Print Spooler within networks, organizations should prioritize patching these flaws as soon as possible,” advised Satnam Narang, staff research engineer at Tenable.
Kevin Breen, Director of Cyber Threat Research at Immersive Labs, says that CVE-2021-36942, a Windows LSA Spoofing Vulnerability, is interesting.
“It fixes a flaw that could be used to steal NTLM hashes from a domain controller or other vulnerable host. These types of attacks are well known for lateral movement and privilege escalation, as has been demonstrated recently by a new exploit called PetitPotam. It is a post intrusion exploit – further down the attack chain – but still a useful tool for attackers,” he noted.
“Microsoft released this patch to further protect against NTLM relay attacks by issuing this update to block the LSARPC interface. This will impact some systems, notably Windows Server 2008 SP2, that use the EFS API OpenEncryptedFileRawA function,” explained Dustin Childs, with Trend Micro’s Zero Day Initiative.
“You should apply this to your Domain Controllers first and follow the additional guidance in ADV210003 and KB5005413. This has been an ongoing issue since 2009, and, likely, this isn’t the last we’ll hear of this persistent issue.”
CVE-2021-34535 is a critical RCE flaw in the Remote Desktop Client that should not be ignored, Childs added and explained: “An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/08/10/cve-2021-36948-patch-tuesday/