Microsoft Issues Patches for In-the-Wild 0-day and 55 Others Windows Bugs

Microsoft on Tuesday issued fixes for 56 flaws, which includes a critical vulnerability that is acknowledged to be actively exploited in the wild.

In all, 11 are detailed as Critical, 43 are shown as Crucial, and two are detailed as Reasonable in severity — six of which are formerly disclosed vulnerabilities.

The updates cover .NET Framework, Azure IoT, Microsoft Dynamics, Microsoft Edge for Android, Microsoft Exchange Server, Microsoft Office, Microsoft Windows Codecs Library, Skype for Business enterprise, Visible Studio, Windows Defender, and other core factors these kinds of as Kernel, TCP/IP, Print Spooler, and Distant Treatment Connect with (RPC).

A Windows Win32k Privilege Escalation Vulnerability

The most critical of the flaws is a Windows Win32k privilege escalation vulnerability (CVE-2021-1732, CVSS rating 7.8) that lets attackers with entry to a target method to run malicious code with elevated permissions. Microsoft credited JinQuan, MaDongZe, TuXiaoYi, and LiHao of DBAPPSecurity for getting and reporting the vulnerability.

In a separate technical produce-up, the scientists mentioned a zero-day exploit leveraging the flaw was detected in a “incredibly constrained quantity of attacks” in opposition to victims situated in China by a menace actor named Bitter APT. The attacks ended up identified in December 2020.

“This zero-working day is a new vulnerability which brought about by acquire32k callback, it could be made use of to escape the sandbox of Microsoft [Internet Explorer] browser or Adobe Reader on the newest Windows 10 model,” DBAPPSecurity scientists mentioned. “The vulnerability is large top quality and the exploit is subtle.”

It can be value noting that Adobe, as component of its February patch, tackled a critical buffer overflow flaw in Adobe Acrobat and Reader for Windows and macOS (CVE-2021-21017) that it said could direct to arbitrary code execution in the context of the present consumer.

The enterprise also warned of active exploitation attempts in opposition to the bug in the wild in minimal attacks targeting Adobe Reader consumers on Windows, mirroring aforementioned results from DBAPPSecurity.

When neither Microsoft nor Adobe has supplied extra aspects, the concurrent patching of the two flaws raises the risk that the vulnerabilities are getting chained to have out the in-the-wild attacks.

Netlogon Enforcement Method Goes Into Impact

Microsoft’s Patch Tuesday update also resolves a number of distant code execution (RCE) flaws in Windows DNS Server (CVE-2021-24078), .NET Core, and Visual Studio (CVE-2021-26701), Microsoft Windows Codecs Library (CVE-2021-24081), and Fax Service (CVE-2021-1722 and CVE-2021-24077).

The RCE in Windows DNS server part is rated 9.8 for severity, building it a critical vulnerability that, if left unpatched, could allow an unauthorized adversary to execute arbitrary code and likely redirect legit traffic to destructive servers.

Microsoft is also having this thirty day period to force the 2nd round of fixes for the Zerologon flaw (CVE-2020-1472) that was at first settled in August 2020, pursuing which reports of active exploitation concentrating on unpatched units emerged in September 2020.

Starting off February 9, the area controller “enforcement mode” will be enabled by default, as a result blocking “susceptible [Netlogon] connections from non-compliant gadgets.”

In addition, the Patch Tuesday update rectifies a bug in Edge browser for Android (CVE-2021-24100) that could disclose personally identifiable info and payment facts of a user.

RCE Flaws in Windows TCP/IP Stack

Finally, the Windows maker produced a set of fixes affecting its TCP/IP implementation — consisting of two RCE flaws (CVE-2021-24074 and CVE-2021-24094) and one particular denial of provider vulnerability (CVE-2021-24086) — that it mentioned could be exploited with a DoS attack.

“The DoS exploits for these CVEs would allow for a remote attacker to result in a halt mistake,” Microsoft explained in an advisory. “Customers might get a blue monitor on any Windows program that is right exposed to the internet with small network targeted visitors. So, we propose customers shift speedily to implement Windows security updates this month.”

The tech giant, on the other hand, mentioned that the complexity of the two TCP/IP RCE flaws would make it really hard to produce functional exploits. But it expects attackers to make DoS exploits significantly far more conveniently, turning the security weak spot into an great applicant for exploitation in the wild.

To put in the hottest security updates, Windows end users can head to Start off > Settings > Update & Security > Windows Update or by deciding on Look at for Windows updates.

Discovered this short article attention-grabbing? Observe THN on Facebook, Twitter  and LinkedIn to study additional distinctive content we write-up.

Some elements of this write-up are sourced from:
thehackernews.com