zerofox logo
Advisories

Patch Tuesday 05/12/2021 Notes

|by Alpha Team

banner image

Microsoft Patch Tuesday 05/11/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

  • Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
  • Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for May 2021 contained 55 vulnerabilities in total, with:

  • 2 vulnerabilities rated as Critical
  • 35 vulnerabilities rated as High
  • 18 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has identified the proof-of-concept (PoC) for CVE-2021-28461, CVE-2021-26419, CVE-2021-31173 and CVE-2021-31936. However, at the time of reporting, no publicly available proofs-of-concept were found.

CVE-2021-31166

CVE-2021-31166 is a remote code execution vulnerability in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the HTTP Protocol Stack. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim. Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.

The following products are impacted:

  • Windows 10 Version 2004 for 32-bit Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server, version 2004 (Server Core installation)
  • Windows Server, version 20H2 (Server Core Installation)

CVE-2021-26419

CVE-2021-26419 is a memory corruption vulnerability in Microsoft Internet Explorer that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the scripting engine. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted:

  • Internet Explorer 11 on Windows 10 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for x64-based Systems
  • Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1
  • Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1
  • Internet Explorer 11 on Windows 8.1 for 32-bit systems
  • Internet Explorer 11 on Windows 8.1 for x64-based systems
  • Internet Explorer 11 on Windows RT 8.1
  • Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Internet Explorer 11 on Windows Server 2012
  • Internet Explorer 11 on Windows Server 2012 R2
  • Internet Explorer 11 on Windows Server 2016
  • Internet Explorer 11 on Windows Server 2019
  • Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2
  • Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2

CVE-2021-31194

CVE-2021-31194 is a remote code execution vulnerability in Microsoft Windows that could allow a local authenticated attacker to execute arbitrary code on the system, caused by a flaw in the OLE Automation. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted:

  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1803 for 32-bit Systems
  • Windows 10 Version 1803 for ARM64-based Systems
  • Windows 10 Version 1803 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for 32-bit systems
  • Windows 8.1 for x64-based systems
  • Windows RT 8.1
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server, version 1909 (Server Core installation)
  • Windows Server, version 2004 (Server Core installation)
  • Windows Server, version 20H2 (Server Core Installation)

CVE-2021-28476

CVE-2021-28476 is a remote code execution vulnerability in Microsoft Windows that could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Hyper-V. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

The following products are impacted:

  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1803 for x64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for x64-based systems
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server, version 1909 (Server Core installation)
  • Windows Server, version 2004 (Server Core installation)
  • Windows Server, version 20H2 (Server Core Installation)

Other Microsoft Vulnerabilities

Other notable Microsoft vulnerabilities include CVE-2021-27068 and CVE-2020-24587. The flaw, CVE-2021-27068, exists in Visual Studio that could allow a remote authenticated attacker to execute arbitrary code on the system. Another bug, CVE-2020-24587, exists in Microsoft Windows that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system.

Users are advised to apply the latest security patches specified in Microsoft's May Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Tags: all industries, global, vulnerability/exploit