Home Industries Update Your Windows PCs Immediately to Patch 4 New 0-Days Under Active...

Update Your Windows PCs Immediately to Patch 4 New 0-Days Under Active Attack


Windows Update

Microsoft on Tuesday rolled out security patches to contain a total of 71 vulnerabilities in Microsoft Windows and other software, including a fix for an actively exploited privilege escalation vulnerability that could be exploited in conjunction with remote code execution bugs to take control over vulnerable systems.

Two of the addressed security flaws are rated Critical, 68 are rated Important, and one is rated Low in severity, with three of the issues listed as publicly known at the time of the release. The four zero-days are as follows —

  • CVE-2021-40449 (CVSS score: 7.8) – Win32k Elevation of Privilege Vulnerability
  • CVE-2021-41335 (CVSS score: 7.8) – Windows Kernel Elevation of Privilege Vulnerability
  • CVE-2021-40469 (CVSS score: 7.2) – Windows DNS Server Remote Code Execution Vulnerability
  • CVE-2021-41338 (CVSS score: 5.5) – Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability

At the top of the list is CVE-2021-40449, a use-after-free vulnerability in the Win32k kernel driver discovered by Kaspersky as being exploited in the wild in late August and early September 2021 as part of a widespread espionage campaign targeting IT companies, defense contractors, and diplomatic entities. The Russian cybersecurity firm dubbed the threat cluster “MysterySnail.”

Automatic GitHub Backups

“Code similarity and re-use of C2 [command-and-control] infrastructure we discovered allowed us to connect these attacks with the actor known as IronHusky and Chinese-speaking APT activity dating back to 2012,” Kaspersky researchers Boris Larin and Costin Raiu said in a technical write-up, with the infection chains leading to the deployment of a remote access trojan capable of collecting and exfiltrating system information from compromised hosts before reaching out to its C2 server for further instructions.

Other bugs of note include remote code execution vulnerabilities affecting Microsoft Exchange Server (CVE-2021-26427), Windows Hyper-V (CVE-2021-38672 and CVE-2021-40461), SharePoint Server (CVE-2021-40487 and CVE-2021-41344), and Microsoft Word (CVE-2021-40486) as well as an information disclosure flaw in Rich Text Edit Control (CVE-2021-40454).

CVE-2021-26427, which has a CVSS score of 9.0 and was identified by the U.S. National Security Agency, underscores that “Exchange servers are high-value targets for hackers looking to penetrate business networks,” Bharat Jogi, senior manager of vulnerability and threat research at Qualys, said.

The October Patch Tuesday is rounded out by fixes for two shortcomings newly discovered in the Print Spooler component — CVE-2021-41332 and CVE-2021-36970 — each concerning an information disclosure bug and a spoofing vulnerability, which has been tagged with an “Exploitation More Likely” exploitability index assessment.

Prevent Ransomware Attacks

“A spoofing vulnerability usually indicates that an attacker can impersonate or identify as another user,” security researcher ollypwn noted in a Twitter thread. “In this case, it looks like an attacker can abuse the Spooler service to upload arbitrary files to other servers.”

Software Patches From Other Vendors

In addition to Microsoft, patches have also been released by a number of other vendors to address several vulnerabilities, including —





Source link

RELATED ARTICLES

Cisco Talos Intelligence Group – Comprehensive Threat Intelligence: Threat Roundup for October 15 to October 22

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 15 and Oct. 22. As with previous roundups, this post...

CIS CSAT Pro v1.7: CIS Controls v8 Assessment and More

The CIS Controls Self Assessment Tool (CIS CSAT) allows organizations to perform assessments on their implementation of the CIS Critical Security Controls (CIS...

Most Popular

‘Critical Severity’ Warning for Malware Embedded in Popular JavaScript Library

Security responders are scrambling this weekend to assess the damage from crypto-mining malware embedded in an npm package (JavaScript library) that counts close...

Popular NPM Package Hijacked to Publish Crypto-mining Malware

The U.S. Cybersecurity and Infrastructure Security Agency on Friday warned of crypto-mining malware embedded in "UAParser.js," a popular JavaScript NPM library with over...

Cisco Talos Intelligence Group – Comprehensive Threat Intelligence: Threat Roundup for October 15 to October 22

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 15 and Oct. 22. As with previous roundups, this post...

Recent Comments