Microsoft Patch Tuesday November 2021

Microsoft patched 55 CVEs in the November 2021 Patch Tuesday release, including six rated as critical, and 49 rated as important.

KB5007186 has arrived for Windows 10 21H1, 20H2, and 2004, while there is KB5007215 for Windows 11.
This month is security focused, with all supported OSes receiving patches for various issues and vulnerabilities.
Windows 10 version 2004 will reach end of servicing on December 14, 2021, and Microsoft now recommends these users to install a newer version of the OS. Windows 10 version 21H2.

CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-42321 is a RCE vulnerability in Microsoft Exchange Server. The flaw exists due to the improper validation of command let arguments. To exploit this vulnerability, an attacker would need to be authenticated to a vulnerable Exchange Server. Microsoft says they are aware of “limited targeted attacks” using this vulnerability in the wild. Additionally, this appears to be the same vulnerability in Exchange Server that was exploited at the Tianfu Cup, a Chinese cybersecurity contest.

CVE-2021-42292 | Microsoft Excel Security Feature Bypass Vulnerability

CVE-2021-42292 is a security feature bypass zero-day in Microsoft Excel that received a 7.8 CVSSv3 score and has been exploited in the wild. Discovery of this flaw is credited to the Microsoft Threat Intelligence Center (MSTIC) but no further information on the vulnerability or the detected exploitations has been published at this time. Microsoft specifically notes that the Preview Pane is not an attack vector for this vulnerability, which means the victim would need to open a malicious Excel document for exploitation to occur. Microsoft notes that patches for Office for Mac are still in progress.

CVE-2021-38666 | Remote Desktop Client Remote Code Execution Vulnerability

CVE-2021-38666 is a RCE vulnerability in the Remote Desktop Client that received a CVSSv3 score of 8.8. The vulnerability can be exploited when a victim machine connects to an attacker controlled Remote Desktop server, allowing the attacker to execute arbitrary code on the victim’s machine.

While no public exploit appears to exist at this time, Microsoft has designated this flaw as “Exploitation More Likely”.

CVE-2021-43208 and CVE-2021-43209 | 3D Viewer Remote Code Execution Vulnerability

CVE-2021-43208 and CVE-2021-43209 are RCE vulnerabilities found in 3D Viewer, a 3D object viewer and augmented reality application for Windows.According to Microsoft, these vulnerabilities have both been publicly disclosed and are attributed to Mat Powell of Trend Micro Zero Day Initiative. While no additional details are available at this time, Microsoft’s advisory does note that affected customers should receive updates automatically from the Microsoft Store. Customers that have automatic updates disabled will have to take action in order to receive this update.

According to the Zero Day Initiative (ZDI), historically, this is a relatively low number of vulnerabilities resolved during the month of November.

Test Patches, Install Patches, Protect Endpoint’s, Happy Patching !