Microsoft patched 55 CVEs in the November 2021 Patch Tuesday release, including six rated as critical, and 49 rated as important.
- KB5007186 has arrived for Windows 10 21H1, 20H2, and 2004, while there is KB5007215 for Windows 11.
- This month is security focused, with all supported OSes receiving patches for various issues and vulnerabilities.
- Windows 10 version 2004 will reach end of servicing on December 14, 2021, and Microsoft now recommends these users to install a newer version of the OS. Windows 10 version 21H2.
This month’s update includes patches for:
- 3D Viewer
- Azure RTOS
- Azure Sphere
- Microsoft Dynamics
- Microsoft Edge (Chromium-based)
- Microsoft Edge (Chromium-based) in IE Mode
- Microsoft Exchange Server
- Microsoft Office
- Microsoft Office Access
- Microsoft Office Excel
- Microsoft Office SharePoint
- Microsoft Office Word
- Microsoft Windows
- Microsoft Windows Codecs Library
- Power BI
- Role: Windows Hyper-V
- Visual Studio
- Visual Studio Code
- Windows Active Directory
- Windows COM
- Windows Core Shell
- Windows Cred SSProvider Protocol
- Windows Defender
- Windows Desktop Bridge
- Windows Diagnostic Hub
- Windows Fastfat Driver
- Windows Feedback Hub
- Windows Hello
- Windows Installer
- Windows Kernel
- Windows NTFS
- Windows RDP
- Windows Scripting
- Windows Virtual Machine Bus
Elevation of privilege vulnerabilities accounted for 36.4% of the vulnerabilities patched this month, followed by remote code execution vulnerabilities at 27.3%.
CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-42321 is a RCE vulnerability in Microsoft Exchange Server. The flaw exists due to the improper validation of command let arguments. To exploit this vulnerability, an attacker would need to be authenticated to a vulnerable Exchange Server. Microsoft says they are aware of “limited targeted attacks” using this vulnerability in the wild. Additionally, this appears to be the same vulnerability in Exchange Server that was exploited at the Tianfu Cup, a Chinese cybersecurity contest.
CVE-2021-42292 | Microsoft Excel Security Feature Bypass Vulnerability
CVE-2021-42292 is a security feature bypass zero-day in Microsoft Excel that received a 7.8 CVSSv3 score and has been exploited in the wild. Discovery of this flaw is credited to the Microsoft Threat Intelligence Center (MSTIC) but no further information on the vulnerability or the detected exploitations has been published at this time. Microsoft specifically notes that the Preview Pane is not an attack vector for this vulnerability, which means the victim would need to open a malicious Excel document for exploitation to occur. Microsoft notes that patches for Office for Mac are still in progress.
CVE-2021-38666 | Remote Desktop Client Remote Code Execution Vulnerability
CVE-2021-38666 is a RCE vulnerability in the Remote Desktop Client that received a CVSSv3 score of 8.8. The vulnerability can be exploited when a victim machine connects to an attacker controlled Remote Desktop server, allowing the attacker to execute arbitrary code on the victim’s machine.
While no public exploit appears to exist at this time, Microsoft has designated this flaw as “Exploitation More Likely”.
Microsoft also provided two other patches for Windows Remote Desktop Protocol this month which could be used in a related scenario. If an attacker is able to take control of an account with RDP server administrator privileges, they could exploit CVE-2021-41371 or CVE-2021-38631 to read Windows RDP client passwords. Both CVE-2021-41371 and CVE-2021-38631 were publicly disclosed.
CVE-2021-43208 and CVE-2021-43209 | 3D Viewer Remote Code Execution Vulnerability
CVE-2021-43208 and CVE-2021-43209 are RCE vulnerabilities found in 3D Viewer, a 3D object viewer and augmented reality application for Windows.According to Microsoft, these vulnerabilities have both been publicly disclosed and are attributed to Mat Powell of Trend Micro Zero Day Initiative. While no additional details are available at this time, Microsoft’s advisory does note that affected customers should receive updates automatically from the Microsoft Store. Customers that have automatic updates disabled will have to take action in order to receive this update.
According to the Zero Day Initiative (ZDI), historically, this is a relatively low number of vulnerabilities resolved during the month of November.
Test Patches, Install Patches, Protect Endpoint’s, Happy Patching !