Patch Tuesday 02/11/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Microsoft's Patch Tuesday update for February 2021 contained 57 vulnerabilities in total, with:

4 vulnerabilities rated as Critical
33 vulnerabilities rated as High
20 vulnerabilities rated as Medium

Microsoft has identified proofs-of-concept for the above-stated high severity vulnerabilities along with CVE-2021-1721, CVE-2021-24101, CVE-2021-1724, CVE-2021-24100, CVE-2021-1730, CVE-2021-24071, CVE-2021-24076, and CVE-2021-24073.

At the time of writing, no publicly available exploits have been identified.

Zero-day Vulnerability CVE-2021-1732 is an elevation of privilege bug in Win32k, a core component of the Windows Operating System. The bug could allow a locally authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges. Reportedly, the bug has been exploited after attackers gained access to a Windows system in order to obtain SYSTEM-level access.

Critical Vulnerabilities

The most notable critical-rated vulnerabilities are tracked as CVE-2021-24078, CVE-2021-24077, CVE-2021-24074, and CVE-2021-24094.

CVE-2021-24078 CVE-2021-24078 is a Remote Code Execution Vulnerability impacting Windows DNS Server. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the DNS Server. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24078:

Windows Server version 1909 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2012 R2 Windows Server 2016 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server version 20H2 (Server Core Installation) Windows Server 2012 R2 (Server Core installation) Windows Server version 2004 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2016

CVE-2021-24077 CVE-2021-24077 is a Remote Code Execution Vulnerability impacting Windows Fax Service. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Fax Service. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24077:

Windows Server version 1909 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows RT 8.1 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows 10 Version 1607 for 32-bit Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows 8.1 for 32-bit systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 10 Version 20H2 for x64-based Systems Windows 7 for x64-based Systems Service Pack 1 Windows Server 2019 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 8.1 for x64-based systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for ARM64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows 10 Version 2004 for x64-based Systems Windows Server 2016 (Server Core installation) Windows Server 2012 R2 Windows 10 Version 2004 for 32-bit Systems Windows Server 2012 (Server Core installation) Windows 10 for 32-bit Systems Windows Server 2012

CVE-2021-24074 CVE-2021-24074 is a Remote Code Execution Vulnerability impacting Windows TCP/IP. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the TCP/IP. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24074:

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server version 1909 (Server Core installation) Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows RT 8.1 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows 10 Version 1607 for 32-bit Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows 8.1 for 32-bit systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows 10 Version 20H2 for x64-based Systems Windows Server 2019 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 8.1 for x64-based systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for ARM64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2012 R2 Windows Server 2016 (Server Core installation) Windows 10 Version 2004 for x64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows Server 2012 (Server Core installation) Windows 10 for 32-bit Systems Windows Server 2012

CVE-2021-24094 CVE-2021-24094 is a Remote Code Execution Vulnerability impacting Windows TCP/IP. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the TCP/IP. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24094:

High-severity Vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2021-24112, CVE-2021-24105, CVE-2021-24081, CVE-2021-1733, and CVE-2021-1727.

CVE-2021-24112 CVE-2021-24112 is a Remote Code Execution Vulnerability in .NET Core. Microsoft .NET Core could allow a remote attacker to execute arbitrary code on the system, caused by an error when a .NET application utilizing libgdiplus on a non-Windows system accepts input. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. This vulnerability impacts the following Microsoft products:

.NET Core 2.1 .NET 5.0 .NET Core 3.1

CVE-2021-24105 CVE-2021-24105 is a Remote Code Execution Vulnerability impacting Package Managers Configurations. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Package Manager Configurations. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim.

CVE-2021-24081 CVE-2021-24081 is a Remote Code Execution Vulnerability impacting Microsoft Windows Codecs Library. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Codecs Library. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim. This vulnerability impacts the following Microsoft products:

Windows Server version 1909 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2019 Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 2004 for x64-based Systems Windows Server 2016 (Server Core installation) Windows 10 Version 2004 for 32-bit Systems Windows 10 for 32-bit Systems

CVE-2021-1733 CVE-2021-1733 is an Elevation of Privilege Vulnerability impacting Sysinternals PsExec. Microsoft PsExec could allow a local authenticated attacker to gain elevated privileges on the system. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2021-1727 CVE-2021-1727 is an Elevation of Privilege Vulnerability impacting Windows Installer. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Installer component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges. This vulnerability impacts the following Microsoft products: Windows Server version 1909 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows RT 8.1 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows 10 Version 1607 for 32-bit Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows 8.1 for 32-bit systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 10 Version 20H2 for x64-based Systems Windows 7 for x64-based Systems Service Pack 1 Windows Server 2019 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 8.1 for x64-based systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for ARM64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows 10 Version 2004 for x64-based Systems Windows Server 2016 (Server Core installation) Windows Server 2012 R2 Windows 10 Version 2004 for 32-bit Systems Windows Server 2012 (Server Core installation) Windows 10 for 32-bit Systems Windows Server 2012

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.