February 2021 Patch Tuesday: Microsoft and Adobe fix exploited zero-days
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet. | 5.5 | 99% | KEV ransomware PoC |
| massmillions of domain controllers worldwide (essentially every Active Directory domain), with hundreds of thousands of domain controllers/RPC endpoints… | |
| CVE-2021-1732 | Out-of-Bounds Write Local Privilege Escalation in Microsoft Win32k (CVE-2021-1732) CVE-2021-1732 is a local elevation-of-privilege vulnerability (CWE-787, out-of-bounds write) in Microsoft's Win32k kernel driver, publicly characterized as an "offset confusion" in the Win32k ConsoleControl routine. It is triggered locally: a process with only low privileges can invoke the vulnerable Win32k functionality without any user interaction, causing a user-supplied offset/pointer to be mishandled in kernel mode and memory to be written out of bounds. An attacker who successfully exploits the flaw can execute code in the kernel and elevate to SYSTEM, gaining full control of the host — which makes it a valuable second-stage link in malware and ransomware chains. Any system running the affected Windows 10 releases (1803, 1809, 1909, 2004, 20H2) or Windows Server 2019/1909/2004/20H2 is exposed, though exploitation requires the attacker to already run code locally on the target. The flaw was fixed in Microsoft's February 2021 Patch Tuesday updates, was added to CISA's KEV catalog on 2021-11-03 with known ransomware use, and carries a very high EPSS score (78.4%, 100th percentile), indicating sustained exploitation pressure. Do: Apply Microsoft's February 2021 (or later) Windows cumulative security updates to all affected Windows 10 and Windows Server systems, per vendor instructions — CISA's KEV listing requires federal agencies to patch. Prioritize hosts exposed to untrusted local users or already compromised by malware (e.g., ransomware or Raspberry Robin activity, which has used chained Windows LPEs), and hunt on unpatched hosts for signs of post-exploitation privilege escalation to SYSTEM. | 7.8 | 78% | KEV ransomware PoC ×2 |
| mass≈1 billion+ Windows devices (the listed builds spanned the mainstream Windows 10/Server install base) | |
| CVE-2021-21017 | Heap-Based Buffer Overflow in Adobe Acrobat and Reader Allows RCE via Malicious PDF CVE-2021-21017 is a heap-based buffer overflow (out-of-bounds write, CWE-122/CWE-787) in Adobe Acrobat and Reader DC that corrupts memory when a specially crafted PDF is processed. Exploitation requires user interaction: a victim must open the malicious PDF file, after which an unauthenticated, network-based attacker can execute arbitrary code in the context of the current user. Successful exploitation effectively gives the attacker the privileges of the victim user on the endpoint, including the ability to run programs and read or modify data. Users running Acrobat Reader DC or Acrobat DC at or below versions 2020.013.20074, 2020.001.30018, or 2017.011.30188 on the Continuous, Classic 2020, and Classic 2017 tracks are affected. The bug was addressed in Adobe's February 2021 updates but has been exploited in the wild - it was added to the CISA KEV catalog on 2021-11-03 - and EPSS assigns an 86.3% probability of exploitation within 30 days (100th percentile). Do: Upgrade all Acrobat and Reader installations to Adobe's February 2021 patched releases or later, per the vendor's instructions, as required by CISA KEV (added 2021-11-03). Inventory endpoints running Continuous, Classic 2020, or Classic 2017 builds at or below the listed versions and verify the running version after patching. Until patched, avoid opening PDFs from untrusted sources, since exploitation requires a victim to open a malicious file. | 8.8 | 86% | KEV |
| masshundreds of millions of user installs worldwide (Reader is the dominant desktop PDF viewer) | |
| CVE-2021-24074 | Windows TCP/IP Remote Code Execution Vulnerability Windows TCP/IP Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 group max | 26% |
| — | ||
| CVE-2021-24078 | Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 11% |
| — | ||
| CVE-2021-26701 | .NET Core Remote Code Execution Vulnerability .NET Core Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.1 | 30% |
| — |
Full article938 words · extracted from helpnetsecurity.com · click to collapse
On this February 2021 Patch Tuesday:
- Adobe has fixed a Reader flaw used in limited attacks, as well as delivered security updates for a variety of products, including Acrobat and Reader, Dreamweaver, and Magento
- Microsoft has plugged 56 security holes, including one actively exploited privilege escalation flaw
- SAP has released 7 new security notes and updated 6 previously released ones
- Mozilla has fixed a critical vulnerability affecting Firefox and Firefox ESR on Windows
Adobe updates
Adobe has released security updates for Acrobat and Reader, Dreamweaver, Photoshop, Illustrator, Animate, and the Magento CMS.
Out of all of those, the Acrobat and Reader updates should be tested and deployed as soon as possible, as they fix a bucketload of critical and important issues in widely used solutions, including one bug (CVE-2021-21017) that is being exploited in “limited” attacks on Reader for Windows.
A little less urgent is the Magento update, not because it doesn’t fix critical flaws (it does, seven of them), but because there are currently no known exploits and because based on previous experience, Adobe does not anticipate them being imminent. Nevertheless, regularly updating Magento installations should be a requirement for website admins, as cybercriminal groups like Magecart often exploit known vulnerabilities to push payment card skimmers onto the sites.
The rest of the updates fix vulnerabilities in products that have historically not been a target for attackers, so you can delay updating until you get all the more critical updates out of the way.
Microsoft updates
Microsoft has plugged 56 security holes, 11 of which are critical, 43 important, and two of moderate severity.
One “important” flaw (CVE-2021-1732) is being actively exploited in the wild: a local privilege escalation flaw that affects various versions of Windows 10 and Windows Server. This one is exploitable by attackers who have local physical access to the target machine, can access it remotely (e.g., via SSH), or can simply trick the legitimate user into opening a malicious document.
“Bugs of this nature are typically paired with another bug that allows code execution at the logged-on user level. For example, this could be paired with an Adobe Reader exploit,” noted Dustin Childs of Trend Micro’s Zero Day Initiative. “An attacker would entice a user to open a specially crafted PDF, which would result in code execution through the Reader bug then escalation through this bug.”
There has been no mention whether this flaw is being exploited along with the actively exploited and now plugged hole in Adobe Reader (CVE-2021-21017 – see above).
CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086 are two RCEs and one DoS vulnerability in Windows’ TCP/IP implementation that have been singled out by Microsoft for a quick patch (or mitigation implementation).
“The two RCE vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely in the short term. We believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release. Thus, we recommend customers move quickly to apply Windows security updates this month,” the MSRC team explained.
“The DoS exploits for these CVEs would allow a remote attacker to cause a stop error. Customers might receive a blue screen on any Windows system that is directly exposed to the internet with minimal network traffic.”
Childs has also advised those depending on Microsoft DNS servers to quickly patch CVE-2021-24078, a critical and potentially wormable RCE flaw, and those rely on the .NET Framework or .NET Core to prioritize fixing CVE-2021-26701, an RCE bug that is publicly known.
Kevin Breen, Director of Cyber Threat Research at Immersive Labs, also notes that CVE-2021-24093, an RCE in Windows Graphics Component, should be quickly patched by consumer Windows users. The bug allows code execution when viewing a specially crafted image and is “the kind of vulnerability built into exploit kits and triggered by low-level phishing campaigns targeting users en masse.”
Satnam Narang, Staff Research Engineer at Tenable, made sure to note that today, Microsoft completed its two-phased approach for addressing CVE-2020-1472 (aka Zerologon).
“Zerologon provides attackers a reliable way to move laterally once inside a network, giving them the ability to impersonate systems, alter passwords, and gain control over the proverbial keys to the kingdom via the domain controller itself. For these reasons, Zerologon has been rolled into attacker playbooks, becoming a feather in the cap for post-compromise activity. We’ve also seen reports of it being favored by ransomware groups like Ryuk during their campaigns,” he shared.
“With this second phase being completed today, organizations that have yet to patch Zerologon need to do so immediately.”
SAP updates
For February 2021 Patch Tuesday, SAP has released 7 new security notes and updates to 6 previously released ones.
The most crucial updates in this batch are for SAP Business Client (fixing a flaw in the browser control Google Chromium delivered with it), SAP Commerce (fixing a RCE), and SAP Business Warehouse.
Mozilla updates
If you or your employees are using Firefox or Firefox ESR on Windows, upgrade to Firefox 85.0.1 or Firefox ESR 78.7.1 to plug a critical buffer overflow bug that has yet to receive a CVE.
Mozilla has fixed on Monday Thunderbird 78.6.1 on Monday and fixed the same bug in its email client.
UPDATE (February 10, 2021, 01:10 a.m. PT):
Apple has released updates for macOS Big Sur, macOS Catalina and macOS Mojave that fix the recently discovered sudo flaw (by updating to sudo version 1.9.5p2) and two vulnerabilities in Intel Graphics Driver that may allow a malicious application to execute arbitrary code with kernel privileges.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/02/09/february-2021-patch-tuesday/