Microsoft Patch Tuesday for Jan. 2021 — Snort rules and prominent vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1643 | HEVC Video Extensions Remote Code Execution Vulnerability HEVC Video Extensions Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 4% |
| — | ||
| CVE-2021-1647 | Remote Code Execution Vulnerability in Microsoft Defender Antimalware Engine CVE-2021-1647 is a remote code execution flaw in Microsoft Defender's antimalware engine, categorized by CISA as a heap-based buffer overflow (CWE-122) arising from improper validation of crafted input values (CWE-1285). It is triggered when the Defender engine processes maliciously crafted content, for example a crafted file delivered via email or the web that Defender scans, causing the overflow during processing. Successful exploitation lets an attacker run arbitrary code on the target machine in the context of the Defender process, potentially leading to full system compromise. Any system running the affected Defender engine is exposed, including Windows 10 and Windows Server deployments where Defender is the default or widely deployed antivirus; the source data provides no fixed version numbers, only the vendor-issued update. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog as of 2021-11-03, indicating exploitation has been observed in the wild, though no public PoC is known and ransomware use is listed as unknown. Do: Apply Microsoft's Defender antimalware engine/platform updates per vendor instructions and ensure Defender security intelligence and platform updates are enabled everywhere, including infrequently updated servers and endpoints. After updating, verify the Defender engine version on high-value hosts is current, prioritizing systems listed in CISA KEV remediation requirements. | 7.8 | 39% | KEV |
| mass≈1 billion+ Windows devices (Defender is the built-in AV on Windows 10 and ships broadly on Windows Server) | |
| CVE-2021-1648 +1 in the same advisory: …1709 | Microsoft splwow64 Elevation of Privilege Vulnerability Microsoft splwow64 Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 group max | 1% |
| — | ||
| CVE-2021-1677 | Azure Active Directory Pod Identity Spoofing Vulnerability Azure Active Directory Pod Identity Spoofing Vulnerability NVD description · AI analysis pending | 5.5 | 1% |
| — | ||
| CVE-2021-1705 | Microsoft Edge (HTML-based) Memory Corruption Vulnerability Microsoft Edge (HTML-based) Memory Corruption Vulnerability NVD description · AI analysis pending | 4.2 | 2% |
| — | ||
| CVE-2021-1707 | Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 4% |
| — |
Full article454 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, January 12, 2021 13:48
By Jon Munshaw, with contributions from Asheer Malhotra.
Microsoft released its monthly security update Tuesday, disclosing 83 vulnerabilities across its suite of products to kick-off 2021.
There are only 10 critical vulnerabilities as part of this release, while there are two moderate-severity exploits, and the remainder is considered “important.” Users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation of all these bugs.
The security updates cover several different products and services, including the Microsoft Defender antivirus software, the Microsoft Remote Procedure Call tools and Bluetooth communication with Windows devices. Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For complete details, check out the latest Snort advisory here.
One of the most serious vulnerabilities exists in Microsoft Defender. CVE-2021-1647 affects some versions of Windows dating back to Windows 2008. An attacker could exploit this vulnerability to execute arbitrary code on the victim machine. No action is required to install this update and protect against this vulnerability, according to Microsoft, as the fix is part of Microsoft’s regular updates to its anti-malware products.
The SharePoint service contains several “important” vulnerabilities. The most notable is CVE-2021-1707, which an attacker could exploit to gain access to create a SharePoint site and then execute code remotely within the kernel if the logged-in user has the appropriate privileges.
Another important vulnerability (CVE-2021-1709) exists in the Win32k system process that requires no user interaction. An attacker could exploit a local machine to elevate their privileges and potentially use these privileges to carry out additional attacks.
Talos would also like to specifically highlight four other vulnerabilities we believe users must be aware of:
- CVE-2021-1677 — Identity spoofing vulnerability in Azure Active Directory Pod
- CVE-2021-1705 — Memory corruption vulnerability in the HTML-based version of Microsoft Edge
- CVE-2021-1648 — Elevation of privilege vulnerability in splwow64
- CVE-2021-1643 — Code execution vulnerability in HEVC video files
For a complete list of all the vulnerabilities Microsoft disclosed this month, check out its update page.
In response to these vulnerability disclosures, Talos is releasing a new SNORTⓇ rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
The rules included in this release that protect against the exploitation of many of these vulnerabilities are 56849 - 56860 and 56865.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-jan-2021/