Microsoft Patch Tuesday 09/14/2021 Notes

Microsoft Patch Tuesday 09/15/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for September 2021 contained 61 vulnerabilities in total, with: 01 vulnerability rated as Critical 44 vulnerabilities rated as High 16 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has identified proof-of-concepts for CVE-2021-36956 and CVE-2021-40440, but they are yet to be publicly available. CVE-2021-40444 is listed as an important-rated vulnerability and is being actively exploited in the wild with a number of proof-of-concept (PoC) exploits publicly available. In addition, Microsoft has also addressed three critical vulnerabilities CVE-2021-38647, CVE-2021-26435, and CVE-2021-36965.

CVE-2021-40444

CVE-2021-40444 is a Remote Code Execution Vulnerability in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the MSHTML Platform. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system, conduct Phishing attacks, and could infect the system with more malware.

The following products are impacted:

• Microsoft Windows Server 2008 SP2 x32
• Microsoft Windows Server 2008 SP2 x64
• Microsoft Windows 7 SP1 x32
• Microsoft Windows 7 SP1 x64
• Microsoft Windows Server 2008 R2 SP1 x64
• Microsoft Windows Server 2012
• Microsoft Windows 8.1 x32
• Microsoft Windows 8.1 x64
• Microsoft Windows Server 2012 R2
• Microsoft Windows RT 8.1
• Microsoft Windows 10 x32
• Microsoft Windows 10 x64
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows 10 1809 for x64-based Systems
• Microsoft Windows 10 1809 for 32-bit Systems
• Microsoft Windows 10 1809 for ARM64-based Systems
• Microsoft Windows 10 1607 for 32-bit Systems
• Microsoft Windows 10 1607 for x64-based Systems
• Microsoft Windows 10 2004 for 32-bit Systems
• Microsoft Windows 10 2004 for ARM64-based Systems
• Microsoft Windows 10 2004 for x64-based Systems
• Microsoft Windows 10 1909 for 32-bit Systems
• Microsoft Windows 10 1909 for x64-based Systems
• Microsoft Windows 10 1909 for ARM64-based Systems
• Microsoft Windows 10 20H2 for 32-bit Systems
• Microsoft Windows 10 20H2 for ARM64-based Systems
• Microsoft Windows 10 20H2 for x64-based Systems
• Microsoft Windows Server (Server Core installation) 2019
• Microsoft Windows Server (Server Core installation) 2004
• Microsoft Windows Server (Server Core installation) 20H2
• Microsoft Windows Server (Server Core installation) 2016
• Microsoft Windows Server (Server Core installation) 2012 R2
• Microsoft Windows Server (Server Core installation) 2012
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
• Microsoft Windows Server for 32-bit systems (Server Core installation) 2008 SP2
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
• Microsoft Windows 10 21H1 for 32-bit Systems
• Microsoft Windows 10 21H1 for ARM64-based Systems
• Microsoft Windows 10 21H1 for x64-based Systems
• Microsoft Windows Server 2022
• Microsoft Windows Server (Server Core installation) 2022

CVE-2021-36956

CVE-2021-36956 is an Information Disclosure Vulnerability in Microsoft Azure Sphere that could allow a local authenticated attacker to obtain sensitive information. By executing a specially crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

The following products are impacted:

Microsoft Azure Sphere

CVE-2021-40440

CVE-2021-40440 is a Cross-Site Scripting Vulnerability in Microsoft Dynamics Business Central, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

The following products are impacted:

​​Microsoft Dynamics 365 Business Central 2020 Release Wave 2 17.10 Microsoft Dynamics 365 Business Central 2021 Release Wave 1 18.5

CVE-2021-38647

CVE-2021-38647 is a Remote Code Execution Vulnerability in Microsoft Azure Open Management Infrastructure that could allow a remote attacker to execute arbitrary code on the system. By executing a specially crafted program, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

Microsoft Azure Open Management Infrastructure

CVE-2021-26435

CVE-2021-26435 is a Memory Corruption Vulnerability in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption flaw in the Scripting Engine component. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

• Microsoft Windows 7 SP1 x32
• Microsoft Windows 7 SP1 x64
• Microsoft Windows Server 2012
• Microsoft Windows 8.1 x32
• Microsoft Windows 8.1 x64
• Microsoft Windows Server 2012 R2
• Microsoft Windows RT 8.1
• Microsoft Windows 10 x32
• Microsoft Windows 10 x64
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows 10 1809 for x64-based Systems
• Microsoft Windows 10 1809 for 32-bit Systems
• Microsoft Windows 10 1809 for ARM64-based Systems
• Microsoft Windows 10 1607 for 32-bit Systems
• Microsoft Windows 10 1607 for x64-based Systems
• Microsoft Windows 10 2004 for 32-bit Systems
• Microsoft Windows 10 2004 for ARM64-based Systems
• Microsoft Windows 10 2004 for x64-based Systems
• Microsoft Windows 10 1909 for 32-bit Systems
• Microsoft Windows 10 1909 for x64-based Systems
• Microsoft Windows 10 1909 for ARM64-based Systems
• Microsoft Windows 10 20H2 for 32-bit Systems
• Microsoft Windows 10 20H2 for ARM64-based Systems
• Microsoft Windows 10 20H2 for x64-based Systems
• Microsoft Windows Server (Server Core installation) 2019
• Microsoft Windows Server (Server Core installation) 2004
• Microsoft Windows Server (Server Core installation) 20H2
• Microsoft Windows Server (Server Core installation) 2016
• Microsoft Windows Server (Server Core installation) 2012 R2
• Microsoft Windows Server (Server Core installation) 2012
• Microsoft Windows Server for X64-based systems 2008 R2 SP1
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
• Microsoft Windows Server for 32-bit systems (Server Core installation) 2008 SP2
• Microsoft Windows Server for 32-bit systems 2008 SP2
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
• Microsoft Windows 10 21H1 for 32-bit Systems
• Microsoft Windows 10 21H1 for ARM64-based Systems
• Microsoft Windows 10 21H1 for x64-based Systems
• Microsoft Windows Server 2022
• Microsoft Windows Server (Server Core installation) 2022
• Microsoft Windows Server for X64-based systems 2008 SP2

CVE-2021-36965

CVE-2021-36965 in Remote Code Execution in Microsoft Windows that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the WLAN AutoConfig Service component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

• Microsoft Windows 7 SP1 x32
• Microsoft Windows 7 SP1 x64
• Microsoft Windows Server 2012
• Microsoft Windows 8.1 x32
• Microsoft Windows 8.1 x64
• Microsoft Windows Server 2012 R2
• Microsoft Windows RT 8.1
• Microsoft Windows 10 x32
• Microsoft Windows 10 x64
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows 10 1809 for x64-based Systems
• Microsoft Windows 10 1809 for 32-bit Systems
• Microsoft Windows 10 1809 for ARM64-based Systems
• Microsoft Windows 10 1607 for 32-bit Systems
• Microsoft Windows 10 1607 for x64-based Systems
• Microsoft Windows 10 2004 for 32-bit Systems
• Microsoft Windows 10 2004 for ARM64-based Systems
• Microsoft Windows 10 2004 for x64-based Systems
• Microsoft Windows 10 1909 for 32-bit Systems
• Microsoft Windows 10 1909 for x64-based Systems
• Microsoft Windows 10 1909 for ARM64-based Systems
• Microsoft Windows 10 20H2 for 32-bit Systems
• Microsoft Windows 10 20H2 for ARM64-based Systems
• Microsoft Windows 10 20H2 for x64-based Systems
• Microsoft Windows Server (Server Core installation) 2019
• Microsoft Windows Server (Server Core installation) 2004
• Microsoft Windows Server (Server Core installation) 20H2
• Microsoft Windows Server (Server Core installation) 2016
• Microsoft Windows Server (Server Core installation) 2012 R2
• Microsoft Windows Server (Server Core installation) 2012
• Microsoft Windows Server for X64-based systems 2008 R2 SP1
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
• Microsoft Windows Server for 32-bit systems (Server Core installation) 2008 SP2
• Microsoft Windows Server for 32-bit systems 2008 SP2
• Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
• Microsoft Windows 10 21H1 for 32-bit Systems
• Microsoft Windows 10 21H1 for ARM64-based Systems
• Microsoft Windows 10 21H1 for x64-based Systems
• Microsoft Windows Server 2022
• Microsoft Windows Server (Server Core installation) 2022
• Microsoft Windows Server for X64-based systems 2008 SP2

Users are advised to apply the latest security patches specified in Microsoft's September Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.