Four Critical Vulnerabilities Patched by Microsoft
7/08/2021

Microsoft released patches for 55 CVEs in Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server on May Patch Tuesday. Of these 55 bugs, four are rated as Critical in severity. The four critical CVEs to which attention should be paid are all remote code execution (RCE) vulnerabilities that could enable malicious actors to gain persistence on victim networks. These are CVE2021-26419, CVE-2021-31166, CVE-2021-31194, and CVE-2021- 28476

OVERVIEW

▪ Microsoft released patches for 55 CVEs in Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server on May Patch Tuesday.

▪ 3 of these bugs came through the Zero Day Initiative program. Of these 55 bugs, four are rated as Critical, 50 are rated as Important, and one is listed as Moderate in severity.

▪ All four critical vulnerabilities announced by Microsoft are new, and security pros are advised to patch in the first 72 hours to reduce risk in safeguarding both data and infrastructure.

▪ It is practically a certainty that malicious actors will be paying close attention to the new disclosures and that in-the-wild exploitation will follow in short order, so applying the patches should be prioritised.

▪ The four critical CVEs to which attention should be paid are all remote code execution (RCE) vulnerabilities that could enable malicious actors to gain persistence on victim networks. These are CVE-2021-26419, CVE-2021-31166, CVE-2021-31194, and CVE-2021- 28476.

▪ The patch Tuesday update corrects a critical bug that could allow an unauthenticated attacker to remotely execute code as kernel (CVE-2021-31166). An attacker would simply need to send a specially crafted packet to an affected server and enabling wormable attacks.

▪ CVE 2021-28476 with a CVSS score of 9.9 affects Hyper-V hosts forcing host's kernel to read from an arbitrary, potentially invalid address. The contents of the address read would not be returned to the guest VM resulting in denial of service of the Hyper-V host (bugcheck).

Sign Up Here for Download