Rewterz Threat Advisory – Patch Tuesdays – Microsoft Patches 6 Zero-Days Under Active Attack

Severity

High

Analysis Summary

Fixes for 50 Microsoft vulnerabilities are available, out of which six are under attack, and three were publicly known at the time of disclosure.

CVE-2021-33742

This bug could allow an attacker to execute code on a target system if a user views specially crafted web content. Since the vulnerability is in the Trident (MSHTML) engine itself, many different applications are impacted – not just Internet Explorer. The vulnerability is being exploited in the wild.

CVE-2021-31199/CVE-2021-31201

These two bugs are elevation of privilege vulnerabilities in the Microsoft Enhanced Cryptographic Provider. Microsoft CVE-2021-31201 and CVE-2021-31199 address vulnerabilities that are related to Adobe’s CVE-2021-28550. The vulnerability is being exploited in the wild.

CVE-2021-33739

This vulnerability is subject to a local escalation of privilege attack. The attacker would most likely arrange to run an executable or script on the local computer. An attacker could gain access to the computer through a variety of methods, such as via a phishing attack where a user clicks an executable file that is attached to an email. The vulnerability is being exploited in the wild.

CVE-2021-31955

This Windows Kernel information disclosure vulnerability allows an attacker to read the contents of kernel memory from a user-mode process. The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the contents of Kernel memory. The vulnerability is being exploited in the wild.

CVE-2021-31956

To exploit this Windows NTFS elevation of privilege vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. 

Additionally, an attacker could convince a local user to open a malicious file. The attacker would have to convince the user to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file. The vulnerability is being exploited in the wild.

Impact

• Remote Code Execution
• Information Disclosure
• Privilege Escalation

Affected Vendors

Microsoft

Affected Products

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Microsoft Windows 10 Version 1607 for x64-based Systems
• Microsoft Windows 10 Version 1607 for 32-bit Systems
• Microsoft Windows 10 for 32-bit Systems
• Microsoft Windows 10 for x64-based Systems
• Windows 10 Version 2004 for x64-based Systems

Remediation

• Update to the latest versions.
• Patch the affected products.

For more information on affected products, patches, and updates refer to the vendor at https://msrc.microsoft.com/update-guide/vulnerability