What We Do
How we do it
Resources
SECURITY ADVISORIES
Jul 29, 2021
UPDATE: PetitPotam NTLM Relay Attack
THE THREAT PetitPotam is a variant of the NTLM Relay attack discovered by security researcher Gilles Lionel. It is tracked as an authentication bypass vulnerability in Active Directory (Certificate Services); currently no CVE identifier has been assigned to this vulnerability. Proof of Concept (PoC) code released last week [1] relies on the Encrypting File System Remote (EFSRPC) protocol to…
Read More
View all Advisories →
Company
ABOUT eSENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Jul 12, 2021
Tecala and eSentire Partner to Protect Enterprises across APAC from Business-Disrupting Cyber Attacks
Sydney, 12 July, 2021 - Tecala, Australia’s award-winning technology services and IT consulting provider, today announced it has chosen eSentire, the global Authority in Managed Detection and Response (MDR) cybersecurity services, as their exclusive MDR solution provider in Australia and New Zealand. This partnership will enable Tecala to augment its cybersecurity practice and offer enterprises…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Resources
Security advisories — Feb 09, 2021

Microsoft Patch Tuesday – Critical Vulnerabilities

3 min read

THE THREAT

In Microsoft’s February Patch Tuesday release, fifty-eight separate vulnerabilities received security patches. Five vulnerabilities from this release stand out as especially concerning.

Microsoft identified a zero-day vulnerability (CVE-2021-1732) impacting Windows 10 devices. The vulnerability has been exploited in the wild prior to patch release for privilege escalation. Additionally, Microsoft released fixes for multiple vulnerabilities in their implementation of TCP/IP (CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086) affecting multiple Windows products. Lastly, Microsoft patched a critical vulnerability in the Windows Fax Service (CVE-2021-24077), that could be exploited to cause remote code execution. These vulnerabilities have not been exploited in the wild at this time, but exploitation is expected in the near future.

It is recommended that organizations apply patches for all impacted products as soon as possible.

What we’re doing about it

What you should do about it

Additional information

Windows Win32k Elevation of Privilege Vulnerability

CVE-2021-1732 (CVSS:3.0 7.8)

A vulnerability exists in the core system component of Windows which could grant system level access when executed. This is a zero-day vulnerability, meaning exploitation in the wild has been identified. Exploitation requires the ability to execute code locally on a device. For a list of affected Windows versions, see Microsoft’s Update Guide.

Multiple Vulnerabilities in Windows implementation of TCP/IP

CVE-2021-24074 (CVSS:3.0 9.8)

CVE-2021-24094 (CVSS:3.0 9.8)

CVE-2021-24086 (CVSS:3.0 7.5)

Microsoft released security updates for three vulnerabilities impacting their implementation of networking TCP/IP protocols. These vulnerabilities affect all Windows versions and should be prioritized for patching or mitigated with workarounds. In their blog post, Microsoft states the vulnerabilities were discovered internally and creating working remote code execution exploits would be complex. Microsoft does warn that Denial-of-Service exploits are more likely to emerge. There is currently no known exploitation of these vulnerabilities in the wild.

Windows Fax Service Remote Code Execution Vulnerability

CVE-2021-24077 (CVSS:3.0 9.8)

A remotely exploitable vulnerability exists in Windows Fax Service. An attacker with network access to a vulnerable device can execute code. In order to exploit this vulnerability, both the Windows Fax and Scan feature and Fax service need to be enabled and running. This vulnerability was discovered by 3rd parties and technical details or proof-of-concept exploits are not public. There are no reports of in-the-wild exploits at this time. For a list of affected Windows versions see Microsoft’s Update Guide.

References:

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732

[2] https://msrc-blog.microsoft.com/2021/02/09/multiple-security-updates-affecting-tcp-ip/

[3] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24077