Patch Tuesday 04/13/2021 Notes

Patch Tuesday 04/13/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

• Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
• Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for March 2021 contained 108 vulnerabilities in total, with:

• 3 vulnerabilities rated as Critical
• 77 vulnerabilities rated as High
• 27 vulnerabilities rated as Medium
• 1 vulnerability rated as Low

Most Notable Vulnerabilities

Microsoft has identified the proofs-of-concept (PoC) for CVE-2021-28449, CVE-2021-28458, CVE-2021-28460,CVE-2021-28456, CVE-2021-28454, CVE-2021-27091, and CVE-2021-27064.

CVE-2021-27091

CVE-2021-27091 is a privilege escalation vulnerability in Microsoft Windows that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the RPC Endpoint Mapper Service. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are impacted by CVE-2021-27091:

• Microsoft Windows 7 SP1 x32
• Microsoft Windows 7 SP1 x64
• Microsoft Windows Server 2008 R2 SP1 x64
• Microsoft Windows Server 2012
• Microsoft Windows Server (Server Core installation) 2012
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1

CVE-2021-28310

CVE-2021-28310 is a privilege escalation vulnerability in Microsoft Windows that could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The CVE is believed to be exploited in the wild, potentially by several threat actors. According to Kaspersky researchers, BITTER APT group are exploiting CVE-2021-28310, who were behind CVE-2021-1732 exploit.

The following products are impacted by CVE-2021-28310:

• Microsoft Windows Server 2019
• Microsoft Windows 10 1809 for x64-based Systems
• Microsoft Windows 10 1809 for 32-bit Systems
• Microsoft Windows 10 1803 for 32-bit Systems
• Microsoft Windows 10 1803 for x64-based Systems
• Microsoft Windows 10 1803 for ARM64-based Systems
• Microsoft Windows 10 1809 for ARM64-based Systems
• Microsoft Windows 10 2004 for 32-bit Systems
• Microsoft Windows 10 2004 for ARM64-based Systems
• Microsoft Windows 10 2004 for x64-based Systems
• Microsoft Windows 10 1909 for 32-bit Systems
• Microsoft Windows 10 1909 for x64-based Systems
• Microsoft Windows 10 1909 for ARM64-based Systems
• Microsoft Windows 10 20H2 for 32-bit Systems
• Microsoft Windows 10 20H2 for ARM64-based Systems
• Microsoft Windows 10 20H2 for x64-based Systems
• Microsoft Windows Server (Server Core installation) 2019
• Microsoft Windows Server (Server Core installation) 1909
• Microsoft Windows Server (Server Core installation) 2004
• Microsoft Windows Server (Server Core installation) 20H2

Other Notable Vulnerabilities

Other notable Microsoft vulnerabilities include CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, CVE-2021-28483. These are flaws in Exchange Server versions 2013-2019 that could allow a remote attacker to execute arbitrary code on the system.

Users are advised to apply the latest security patches specified in Microsoft's April Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.