Microsoft Patches Multiple Zero-Day Bugs

Microsoft fixed 74 new CVEs yesterday, including a number of zero-day vulnerabilities, a person of which is getting actively exploited in the wild.

Zero-day bug CVE-2021-40449 is a Gain32k elevation of privilege vulnerability in Windows affecting Windows 7 and Server 2008 up to Windows 11 and Server 2022. It has reportedly been exploited by Chinese risk actors recognised as “IronHusky.”

“Microsoft only rated the vulnerability as “important” by their severity scoring technique, which is a fantastic illustration of why organizations have to have to emphasis on vulnerability remediation primarily based on risk,” argued Ivanti senior director of products administration, Chris Goettl.

“A risk-based mostly technique to vulnerability administration takes into account much more authentic-entire world indicators this sort of as regarded exploited, community disclosure, and usage trends by threat actors to greater comprehend what exposures you ought to be concentrating on very first.”

Microsoft also fixed 3 publicly disclosed (zero-day) flaws which have had evidence-of-idea code launched, giving attackers a head-begin in crafting exploits for them.

These are CVE-2021-41338, a security aspect bypass vulnerability in Windows AppContainer Firewall Windows kernel elevation of privilege bug CVE-2021-41335 and Windows DNS distant code execution vulnerability CVE-2021-40469.

There was also an updated repair for CVE-2021-33781, a security function bypass flaw in Azure Ad. This vulnerability was in the beginning resolved in the July Patch Tuesday but has been current to take care of Windows 10 v1607, Server 2016 and Windows 11.

Elsewhere, Adobe up to date Acrobat, Reader, Hook up, Reader Cellular, Commerce, Campaign Normal and ops-cli.

“The updates for Adobe Join (APSB21-91) and ops-cli (APSB21-88) involve critical CVEs with a CVSS base rating of 9.8 out of 10,” stated Goettl.

“Adobe Acrobat and Reader (APSB21-104) resolves the most CVEs out of the line-up. A whole of four CVEs, two of which are rated as Critical with CVSS scores of 7.8 were fixed in this update.”

Some parts of this article are sourced from:
www.infosecurity-journal.com