Microsoft Nov. Patch Tuesday Fixes Six Zero-Days, 55 Bugs

Microsoft described a total of 55 vulnerabilities, 6 of which are rated critical, with the remaining 49 being rated vital. The flaws are uncovered in Microsoft Windows and Windows Components, Azure, Azure RTOS, Azure Sphere, Microsoft Dynamics, Microsoft Edge (Chromium-based mostly), Exchange Server, Microsoft Office environment and Office environment Factors, Windows Hyper-V, Windows Defender, and Visible Studio.

All in all, it’s a pretty light-weight month, according to the Zero Working day Initiative’s (ZDI’s) Dustin Childs. “Historically talking, 55 patches in November is a relatively reduced quantity,” he commentd. “Even likely back again to 2018 when there had been only 691 CVEs mounted all calendar year, there ended up far more November CVEs.”

Still, as often, this Patch Tuesday provides high-precedence fixes, the most urgent of which staying the duo that are under attack.

Higher-Priority, Actively Exploited Pair of Bugs

CVE-2021-42321: Microsoft Trade Server Remote Code Execution Vulnerability.

This is a critical remote code execution (RCE) weak point in Trade Server triggered by issues with the validation of command-allow (cmdlet) arguments – i.e., lightweight instructions utilized in the PowerShell surroundings. They’re invoked by PowerShell runtime within the context of automation scripts that are offered at the command line or invoked programmatically by the PowerShell runtime through APIs. Microsoft mentioned that the vulnerability, rated 8.8 in criticality, has small attack complexity.

In buy to exploit this flaw, an attacker would need to be authenticated, which boundaries some of the influence, as mentioned by Satnam Narang, team study engineer at Tenable. Microsoft states they are mindful of “limited targeted attacks” making use of this vulnerability in the wild.

Microsoft has a blog site article describing the vulnerability and how it’s exploited.

Microsoft Exchange Server has been the topic of quite a few noteworthy vulnerabilities during 2021, which include ProxyLogon and linked vulnerabilities as very well as ProxyShell, Narang pointed out.

“Though unconfirmed, this may possibly be identical to an Trade Server vulnerability that was discovered at the Tianfu Cup hacking opposition very last thirty day period,” Narang instructed.

Narang reported that federal or governing administration bodies in the United States may be sure by the current CISA directive 22-01 that places an emphasis on more quickly patching of exploits that are actively staying applied by attackers. “This vulnerability – together with CVE-2021-42292 – would probably fall into that class,” he famous in an email on Tuesday.

In spite of actively playing a starring purpose at the Tianfu Cup, this flaw was truly uncovered by the Microsoft Risk Intelligence Centre (MSTIC). Microsoft stated that it is been actively utilized in assaults.

CVE-2021-42292: Microsoft Excel Security Feature Bypass Vulnerability.

This patch fixes a security aspect bypass vulnerability ​​in Microsoft Excel for both Windows and MacOS personal computers that could allow code execution when opening a specifically crafted file. It much too was identified by MSTIC, which said that it’s also been exploited in the wild as a zero working day.

In accordance to Development Micro’s Zero Day Initiative (ZDI) November Security Update, “This is likely because of to loading code that really should be guiding a prompt, but for whichever rationale, that prompt does not appear, as a result bypassing that security characteristic.”

Microsoft does not propose what influence the vulnerability might have, but its CVSS score of 7.8 presents it a severity score of significant. Kevin Breen, director of cyber threat exploration at Immersive Labs, advised Threatpost on Tuesday that the deficiency of element “can make it difficult to prioritize, but something that is currently being exploited in the wild should be at the extremely best of your checklist to patch.”

Microsoft said that the Outlook Preview Pane is not an attack vector for this weak spot, so a focus on would want to open the file in purchase for exploitation to arise.

Updates are obtainable for Windows devices, but updates for Business for Mac aren’t out yet.

Narang instructed that provided the absence of description and a lack of updates for a vulnerability staying exploited in the wild, “it might be worth telling any person in your organization applying Office environment for Mac to be a lot more careful until eventually patches are produced obtainable.”

Other Bugs of Be aware

CVE-2021-42298: Microsoft Defender Distant Code Execution Vulnerability.

Defender is developed to scan each and every file and run with some of the optimum stages or privileges in the operating method. This indicates an attacker could cause the exploit by merely sending a file – the target would not even need to open or operate everything, defined Kevin Breen, director of cyber threat study at Immersive Labs.

Breen instructed Threatpost on Tuesday that this is the reason that CVE-2021-42298 is marked as “exploitation extra most likely.”

“As it is not remaining exploited in the wild, it should really get updated without any manual intervention from directors,” he claimed via email. “That staying said, it’s certainly well worth examining to make sure your Defender installations are getting their updates set the right way.”

Microsoft’s advisory involves methods to verify that people have the most current variations mounted.

CVE-2021-38666: Remote Desktop Shopper Distant Code Execution Vulnerability.

Microsoft mentioned that in the scenario of a Remote Desktop relationship, an attacker with management of a Remote Desktop Server could trigger an RCE on the RDP shopper device when a target connects to the attacking server with the susceptible Remote Desktop Customer.

That is not the clearest description, Breen noted, but the attack vector implies that the distant desktop shopper installed on all supported versions of Windows has a vulnerability.

“To exploit it, an attacker would have to create their individual server and convince a user to hook up to the attacker,” Breen stated. “There are quite a few strategies an attacker could do this, one particular of which could be to send out the concentrate on an RDP shortcut file, both by using email or a obtain. If the concentrate on opens this file, which in by itself is not destructive, they could be giving the attacker accessibility to their process.”

Breen mentioned in an email that in addition to patching this flaw, a reasonable step would be to insert detections for RDP information staying shared in e-mails or downloads.

CVE-2021-38631 & CVE-2021-41371: Information and facts Disclosure Vulnerabilities in Microsoft Distant Desktop Protocol (RDP).

These flaws were earlier publicly disclosed by security researchers. Successful exploitation of would allow an attacker to see RDP passwords for the vulnerable procedure.

The issue influences RDP functioning on Windows 7 – 11 and Windows Server 2008 – 2019. They are rated “Important” by Microsoft. Supplied the curiosity that cybercriminals (particularly ransomware first obtain brokers) have in RDP, “it is possible that it will be exploited at some place,” Liska reported.

Steady Trade Vulnerabilities

Exchange vulnerabilities have been of individual issue this year, observed Allan Liska, senior security architect at Recorded Upcoming. Liska pointed to both Chinese nation condition actors and the cybercriminals behind the DearCry ransomware (also thought to be running out of China) as getting exploited before vulnerabilities in Microsoft Exchange (CVE-2021-26855 and CVE-2021-27065).

“While Microsoft only rates the vulnerability as ‘Important’ due to the fact an attacker has to be authenticated to exploit it, Recorded Upcoming has pointed out that attaining genuine credential accessibility to Windows devices has develop into trivial for both country condition and cybercriminal actors,” Liska claimed via email. Consequently, he suggested prioritizing this flaw for patching.

Prioritize CVE-2021-42292, Too

Microsoft was not distinct about which security element is bypassed by this security feature bypass vulnerability for Microsoft Excel for both equally Windows and MacOS computer systems, which has an effect on versions 2013 – 2021. But the point that it’s staying exploited in the wild “is regarding,” Liska claimed and “means it ought to be prioritized for patching.”

Microsoft Excel is a recurrent goal of both equally country-condition attackers and cybercriminals, he pointed out.

Want to earn back handle of the flimsy passwords standing between your network and the future cyberattack? Sign up for Darren James, head of interior IT at Specops, and Roger Grimes, knowledge-driven defense evangelist at KnowBe4, to discover out how all through a no cost, Stay Threatpost event, “Password Reset: Claiming Control of Qualifications to Cease Assaults,” on Wed., Nov. 17 at 2 p.m. ET. Introduced to you by Specops.

Register NOW for the Stay occasion and submit queries in advance of time to Threatpost’s Becky Bracken at [email protected].