Microsoft Patches Four More Critical Exchange Server Bugs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-27091 | RPC Endpoint Mapper Service Elevation of Privilege Vulnerability RPC Endpoint Mapper Service Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2021-28310 | Out-of-Bounds Write in Microsoft Win32k Allows Local Privilege Escalation on Windows 10 CVE-2021-28310 is an elevation-of-privilege flaw caused by an out-of-bounds write (CWE-787) in the Windows Win32k kernel component. A local attacker who can already execute low-privileged code on a vulnerable system can trigger the memory corruption bug to run arbitrary code in kernel mode, with no user interaction required. Successful exploitation grants SYSTEM/kernel-level control of the host, typically as a follow-on step after an attacker has gained an initial foothold, rather than a remote-entry vector. Windows 10 versions 1803, 1809, 1909, 2004 and 20H2, plus the corresponding Windows Server versions 1909, 2004, 2019 and 20H2, are affected. The flaw was fixed in Microsoft's April 2021 security updates and has been actively exploited in the wild — CISA added it to the KEV catalog on 2021-11-03, and its EPSS of 8.3% (95th percentile) signals elevated exploitation risk. Do: Apply the April 2021 (or later) Windows cumulative security updates to all affected Windows 10 and Windows Server systems, prioritizing hosts where untrusted or low-privileged users can run code, such as terminal/RDS servers, VDI and shared workstations. Because this flaw is in the CISA KEV catalog, applying vendor updates is a required action for federal and regulated environments; verify remediation by confirming the installed OS build includes the April 2021 patch. For systems that cannot be patched promptly, limit local code execution by untrusted users and monitor for post-exploitation privilege-escalation behavior. | 7.8 | 8% | KEV |
| masshundreds of millions of Windows 10 and Windows Server endpoints worldwide | |
| CVE-2021-28480 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 group max | 71% |
| — |
Full article304 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft released patches for over 100 flaws for the first time this year yesterday, including one being actively exploited in the wild and four new critical Exchange Server bugs reported by the NSA.
The haul of 110 CVEs will keep sysadmins busy, with experts highlighting the zero-day elevation of privilege flaw in Win32k (CVE-2021-28310) as worthy of attention.
Although only rated as important, it may have been exploited in attacks for over a month already, according to Ivanti senior director of product management, Chris Goettl.
“This is a good example of the importance of using a risk-based prioritization approach. If you are basing your prioritization off vendor severity and looking at just the critical CVEs, you may have missed this one,” he explained.
“Fortunately for those organizations, this is part of the Windows 10 cumulative this month — which also includes Critical CVEs — but broadening your prioritization metrics to include risk metadata like exploited, publicly disclosed, and other indicators will help to ensure you prioritize the best possible set of updates to remediate in a timely fashion.”
The four critical Exchange Server flaws should also be a priority for sysadmins. CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, and CVE-2021-28483 are remote code execution bugs that all affect Microsoft Exchange Server versions 2013 to 2019.
Recorded Future senior solutions architect, Allan Liska, flagged elevation of privilege vulnerability CVE-2021-27091 as worthy of attention, as it has been publicly disclosed.
“Microsoft labelled this vulnerability important and it impacts Windows 7 and Windows Server 2008 and 2012,” he explained.
“While RPC vulnerabilities are not usually widely exploited in the wild, this could be an interesting one to watch out for as attackers often use RPC to execute code on remote systems. This vulnerability would allow an attacker to execute remote code at a higher privileged level.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-patch-four-critical/