What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Nov 21, 2022
ProxyNotShell Exploit Released
THE THREAT eSentire is aware of public Proof-of-Concept (PoC) exploit code for the ProxyNotShell Exchange vulnerabilities (CVE-2022-41040 [CVSS:8.8], CVE-2022-41082 [CVSS:8.0]). The publication of…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Nov 07, 2022
Global Cybersecurity Leader eSentire Partners with InfoTrust to Deliver 24/7 Multi-Signal MDR and IR Services Across Australia
Waterloo, ON and Sydney, Australia – November 9, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has expanded its presence in Australia via a strategic partnership with InfoTrust. InfoTrust is a leading specialized cybersecurity provider that combines next-generation security controls, with the InfoTrust “Connective Tissue” of customer success,…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Security advisories — Feb 09, 2021

Microsoft Patch Tuesday – Critical Vulnerabilities

2 minutes read
Speak With A Security Expert Now

THE THREAT

In Microsoft’s February Patch Tuesday release, fifty-eight separate vulnerabilities received security patches. Five vulnerabilities from this release stand out as especially concerning.

Microsoft identified a zero-day vulnerability (CVE-2021-1732) impacting Windows 10 devices. The vulnerability has been exploited in the wild prior to patch release for privilege escalation. Additionally, Microsoft released fixes for multiple vulnerabilities in their implementation of TCP/IP (CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086) affecting multiple Windows products. Lastly, Microsoft patched a critical vulnerability in the Windows Fax Service (CVE-2021-24077), that could be exploited to cause remote code execution. These vulnerabilities have not been exploited in the wild at this time, but exploitation is expected in the near future.

It is recommended that organizations apply patches for all impacted products as soon as possible.

What we’re doing about it

What you should do about it

Additional information

Windows Win32k Elevation of Privilege Vulnerability

CVE-2021-1732 (CVSS:3.0 7.8)

A vulnerability exists in the core system component of Windows which could grant system level access when executed. This is a zero-day vulnerability, meaning exploitation in the wild has been identified. Exploitation requires the ability to execute code locally on a device. For a list of affected Windows versions, see Microsoft’s Update Guide.

Multiple Vulnerabilities in Windows implementation of TCP/IP

CVE-2021-24074 (CVSS:3.0 9.8)

CVE-2021-24094 (CVSS:3.0 9.8)

CVE-2021-24086 (CVSS:3.0 7.5)

Microsoft released security updates for three vulnerabilities impacting their implementation of networking TCP/IP protocols. These vulnerabilities affect all Windows versions and should be prioritized for patching or mitigated with workarounds. In their blog post, Microsoft states the vulnerabilities were discovered internally and creating working remote code execution exploits would be complex. Microsoft does warn that Denial-of-Service exploits are more likely to emerge. There is currently no known exploitation of these vulnerabilities in the wild.

Windows Fax Service Remote Code Execution Vulnerability

CVE-2021-24077 (CVSS:3.0 9.8)

A remotely exploitable vulnerability exists in Windows Fax Service. An attacker with network access to a vulnerable device can execute code. In order to exploit this vulnerability, both the Windows Fax and Scan feature and Fax service need to be enabled and running. This vulnerability was discovered by 3rd parties and technical details or proof-of-concept exploits are not public. There are no reports of in-the-wild exploits at this time. For a list of affected Windows versions see Microsoft’s Update Guide.

References:

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732

[2] https://msrc-blog.microsoft.com/2021/02/09/multiple-security-updates-affecting-tcp-ip/

[3] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24077

View Most Recent Blogs