zerofox logo
Advisories

Microsoft Patch Tuesday 11/09/2021 Notes

Alpha Team
banner image

Microsoft Patch Tuesday 11/09/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

  • Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
  • Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:
Microsoft's Patch Tuesday update for November 2021 contained 55 vulnerabilities in total, with:

  • 2 vulnerabilities rated as Critical
  • 28 vulnerabilities rated as High
  • 21 vulnerabilities rated as Medium
  • 4 vulnerabilities rated as Low

Most notable vulnerabilities

Microsoft has listed six zero-days vulnerabilities, CVE-2021-42292, CVE-2021-42321, CVE-2021-38631, CVE-2021-41371, CVE-2021-43208, and CVE-2021-43209, which are being fixed in the November Patch Tuesday security update; among these, CVE-2021-42292 and CVE-2021-42321 are detected being actively exploited in the wild.

CVE-2021-42292

CVE-2021-42292 is a Security Feature Bypass Vulnerability in Microsoft Excel that could allow a remote attacker to bypass security restrictions. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to bypass security features and gain access to the system.

The following products are impacted:

  • Microsoft Office 2013 Service Pack 1 (64-bit editions)
  • Microsoft Office 2013 Service Pack 1 (32-bit editions)
  • Microsoft Office 2013 RT Service Pack 1
  • Microsoft Excel 2013 Service Pack 1 (64-bit editions)
  • Microsoft Excel 2013 Service Pack 1 (32-bit editions)
  • Microsoft Excel 2013 RT Service Pack 1
  • Microsoft Office 2016 (64-bit edition)
  • Microsoft Office 2016 (32-bit edition)
  • Microsoft Excel 2016 (64-bit edition)
  • Microsoft Excel 2016 (32-bit edition)
  • Microsoft Office LTSC 2021 for 32-bit editions
  • Microsoft Office LTSC 2021 for 64-bit editions
  • Microsoft Office LTSC for Mac 2021
  • Microsoft 365 Apps for Enterprise for 64-bit Systems
  • Microsoft 365 Apps for Enterprise for 32-bit Systems
  • Microsoft Office 2019 for Mac
  • Microsoft Office 2019 for 64-bit editions
  • Microsoft Office 2019 for 32-bit editions

CVE-2021-42321

CVE-2021-42321 is a Remote Code Execution Vulnerability in Microsoft Exchange Server that could allow a remote authenticated attacker to execute arbitrary code on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • Microsoft Exchange Server 2019 Cumulative Update 11
  • Microsoft Exchange Server 2016 Cumulative Update 22
  • Microsoft Exchange Server 2019 Cumulative Update 10
  • Microsoft Exchange Server 2016 Cumulative Update 21

CVE-2021-38631

CVE-2021-38631 is an Information Disclosure Vulnerability in Windows Remote Desktop Protocol (RDP) that could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the Remote Desktop Protocol (RDP). By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

The following products are impacted:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2021-41371

CVE-2021-41371 is an Information Disclosure Vulnerability in Windows Remote Desktop Protocol (RDP) that could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the Remote Desktop Protocol (RDP). By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

The following products are impacted:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows RT 8.1
  • Windows 8.1 for x64-based systems
  • Windows 8.1 for 32-bit systems
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 11 for ARM64-based Systems
  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2021-43208

CVE-2021-43208 is a Remote Code Execution Vulnerability in 3D Viewer that could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • 3D Viewer

CVE-2021-43209

CVE-2021-43209 is a Remote Code Execution Vulnerability in 3D Viewer that could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • 3D Viewer

CVE-2021-3711

CVE-2021-3711 is a Buffer Overflow Vulnerability in OpenSSL that is affecting Microsoft Visual Studio. It is caused by improper bounds checking by the EVP_PKEY_decrypt() function within implementation of the SM2 decryption. By sending specially crafted SM2 content, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

The following products are impacted:

  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
  • Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
  • Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

CVE-2021-26443

CVE-2021-26443 is a Remote Code Execution Vulnerability in Microsoft Virtual Machine Bus (VMBus) that could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Virtual Machine Bus (VMBus) component. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are impacted:

  • Windows 11 for x64-based Systems
  • Windows Server version 20H2 (Server Core Installation)
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server version 2004 (Server Core installation)
  • Windows 10 Version 2004 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for x64-based Systems

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Tags:
VULN Exploitation
VULN Community
VULN Publication
all industries
global
vulnerability/exploit