Microsoft February 2021 Patch Tuesday fixes 56 bugs, including Windows zero-day

Microsoft has released today its monthly batch of security updates, known as Patch Tuesday. This month, the OS maker has fixed 56 security vulnerabilities, including a Windows bug that was being exploited in the wild before today’s patches.

Tracked as CVE-2021-1732, the Windows zero-day is an elevation of privelege bug in Win32k, a core component of the Windows operating system.

The bug was exploited after attackers gained access to a Windows system in order to obtain SYSTEM-level access.

Details about the attacks where this bug was used were not revealed. Microsoft credited three security researchers from Chinese security firm DBAPPSecurity with discovering the attacks where this zero-day was employed.

Many bug details went public

Besides the zero-day, this month’s Patch Tuesday also stands out because of the high number of vulnerabilities whose details were made public even before patches were available.

In total, six Microsoft product bugs had their details posted online before today’s patches. This included:

• CVE-2021-1721 – .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2021-1733 – Sysinternals PsExec Elevation of Privilege Vulnerability
• CVE-2021-26701 – .NET Core Remote Code Execution Vulnerability
• CVE-2021-1727 – Windows Installer Elevation of Privilege Vulnerability
• CVE-2021-24098 – Windows Console Driver Denial of Service Vulnerability
• CVE-2021-24106 – Windows DirectX Information Disclosure Vulnerability

The good news is that none of these bugs were exploited by attackers, despite their details being posted online.

Warning about TCP/IP bugs

But that’s not all. This month, Microsoft has also released fixes for three vulnerabilities in the Windows TCP/IP stack, which allows the operating system to connect to the internet.

Two of these bugs (CVE-2021-24074, CVE-2021-24094) apply fixes for remote code execution vulnerabilities that could allow attackers to take over Windows systems remotely.

A third bug (CVE-2021-24086) could be used to crash Windows devices.

“The two RCE vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely [to be exploited] in the short term,” Microsoft said in a blog post specifically published to warn about these three issues.

“We believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release,” the company added. “Thus, we recommend customers move quickly to apply Windows security updates this month.”

Of all Windows systems, Windows Server instances are the ones most likely to be susceptible to attacks, as many are used to host web servers or cloud infrastructure and are almost certainly connected to the internet at all times and exposed to attacks.

“It is essential that customers apply Windows updates to address these vulnerabilities as soon as possible,” Microsoft said.

If patches can’t be applied right away, various workarounds can be deployed, details in each vulnerability’s advisory.

Below are additional details about today’s Microsoft Patch Tuesday and security updates released by other tech companies:

• Microsoft’s official Security Update Guide portal lists all security updates in a filterable table.
• ZDNet has published this file listing all this month’s security advisories on one single page.
• Adobe’s security updates are detailed here.
• SAP security updates are available here.
• Intel security updates are available here.
• VMWare security updates are available here.
• Chrome 88 security updates are detailed here.
• Android security updates are available here.

Source: Information Technologies - zdnet.com