Patch Tuesday 01/13/2021 Notes

Microsoft Patch Tuesday 01/13/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Highlights: Microsoft's Patch Tuesday update for January 2021 contained 83 vulnerabilities in total, with: 63 vulnerabilities rated as High 20 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has identified the proofs-of-concept for CVE-2021-1647, CVE-2021-1643, CVE-2021-1648, and CVE-2021-1705. However, at the time of reporting, no publicly available proofs-of-concept were found.

CVE-2021-1647 CVE-2021-1647 is a remote code execution (RCE) bug in Microsoft Defender that could allow threat actors to execute code on vulnerable devices by tricking a user into opening a malicious document on the target system. The vulnerability is rated high and has received a severity score of 7.8 (CVSS v3). According to Microsoft, CVE-2021-1647 is a zero-day vulnerability that is being actively exploited in the wild.

The following products are impacted by CVE-2021-1647:

Microsoft Security Essentials Microsoft System Center 2012 Endpoint Protection Microsoft System Center 2012 R2 Endpoint Protection Windows Defender Microsoft System Center Endpoint Protection

CVE-2021-1643 CVE-2021-1643 is a remote code execution vulnerability in HEVC Video Extensions that could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2021-1648 CVE-2021-1648 is an elevation of privilege vulnerability in Microsoft splwow64 that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the splwow64. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are impacted by CVE-2021-1648:

Windows 8.1 for x64-based systems Windows Server 2012 Windows 10 Version 1809 for ARM64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server 2019 Windows 10 Version 1803 for x64-based Systems Windows Server 2012 R2 (Server Core installation) Windows 10 Version 2004 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows RT 8.1 Windows 8.1 for 32-bit systems Windows Server 2019 (Server Core installation) Windows Server 2012 R2 Windows 10 Version 2004 for 32-bit Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 1607 for x64-based Systems Windows Server 2012 (Server Core installation) Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 10 for x64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows Server version 1909 (Server Core installation) Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server 2016 (Server Core installation) Windows 10 Version 20H2 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems

CVE-2021-1705 CVE-2021-1705 is a code execution vulnerability in Microsoft Edge (HTML-based) that could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption vulnerability. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

Other Microsoft Vulnerabilities Other notable Microsoft vulnerabilities include CVE-2021-1709, an elevation of privilege vulnerability in Microsoft Windows Win32k that could allow a locally authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k. CVE-2021-1707 is a remote code execution vulnerability in Microsoft SharePoint Server that could allow a remote authenticated attacker to execute arbitrary code on the system.

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.