CISA Urges Firms to Mitigate New Windows RCE Bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) |
Full article276 words · extracted from infosecurity-magazine.com · click to collapse
The US authorities are urging IT teams to follow newly released guidance from Microsoft designed to help mitigate a flaw in Windows currently under active exploitation.
High severity remote code execution bug CVE-2021-40444 exists in Windows browser engine MSHTML. Microsoft revealed in a note yesterday that the vulnerability is being used in targeted attacks featuring specially crafted Office documents. It could enable a remote attacker to hijack an affected system.
“An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,” it explained.
“The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”
Although no patch is yet available, Microsoft said that, by default, Office opens documents from the internet in Protected View or Application Guard for Office, which will prevent the attack.
It added that organizations could also disable their installation of all ActiveX controls in Internet Explorer to mitigate the threat. This can apparently be done for all sites by updating the registry.
Reports suggest the attacks spotted in the wild are being launched against customers using Microsoft 365 and Office 2019 on Windows 10.
“Vulnerabilities like these tend to have extremely long lifetimes for exploitation in the wild, highlighting the need for security monitoring and periodic threat hunting,” warned Jake Williams, CTO at incident response firm BreachQuest.
An alert from the US Cybersecurity and Infrastructure Security Agency (CISA) yesterday urged users and administrators to implement the workarounds or mitigations suggested by Microsoft.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisa-mitigate-windows-rce-bug/