Microsoft Patch Tuesday – Six Zero-Day Vulnerabilities

THE THREAT

On June 8th, Microsoft released security updates to address a total of 50 unique vulnerabilities in their products. These vulnerabilities were disclosed as part of Microsoft’s monthly Patch Tuesday software update. Six vulnerabilities are classified as zero-days, meaning they have been exploited in the wild prior to patch release and are of the most concern. Four of the zero-day vulnerabilities allow for privilege escalation, one allows for information disclosure, and the final vulnerability may be exploited to cause Remote Code Execution (RCE).

Organizations are recommended to immediately prioritize installation of software updates provided by Microsoft to mitigate ongoing activity by threat actors to exploit these zero-day vulnerabilities.

What we’re doing about it

• MVS has plugins in place to detect all of the zero-day vulnerabilities released by Microsoft
• eSentire security teams are actively reviewing customers for known Indicators of Compromise (IoCs) related to the exploitation of CVE-2021-31955 and CVE-2021-31956
  • Any customers with signs of compromise will be notified directly
• eSentire security teams are tracking these vulnerabilities for additional information and detection measures

What you should do about it

• After performing a business impact review, apply the official security patches from Microsoft

Additional information

The following vulnerabilities are all reported to have been exploited by threat actors prior to patch release:

CVE-2021-33739 (CVSS: 8.4): Microsoft DWM Core Library Elevation of Privilege Vulnerability

• Exploitation of this vulnerability requires previous access by the adversary; privileges are not required
• Impacted products include Windows Server (multiple versions) and Windows 10 (multiple versions)

CVE-2021-31956 (CVSS: 7.8): Windows NTFS Elevation of Privilege Vulnerability

• Exploitation of this vulnerability requires previous access by the adversary; low-level privileges are required
• In an attack scenario, a threat actor would be required to convince a local user to open a malicious file, no other user interaction is required
• Impacted products include Windows Server (multiple versions), Windows 10 (multiple versions), Windows 8 (multiple versions), and Windows 7 (multiple versions)

CVE-2021-33742 (CVSS: 7.5): Windows MSHTML Platform Remote Code Execution Vulnerability

• Exploitation does not require previous authentication or privileges on the vulnerable device
• Impacted Products include all supported versions of Microsoft Windows

CVE-2021-31199 (CVSS: 5.2): Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

• Related to the Adobe vulnerability CVE-2021-28550
• Exploitation of this vulnerability requires previous access by the adversary; low-level privileges are required
• Impacted products include Windows Server (multiple versions), Windows 10 (multiple versions), Windows 8 (multiple versions), and Windows 7 (multiple versions)

CVE-2021-31201 (CVSS: 5.2): Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

• Related to the Adobe vulnerability CVE-2021-28550
• Exploitation of this vulnerability requires previous access by the adversary; low-level privileges are required
• Impacted products include Windows Server (multiple versions), Windows 10 (multiple versions), Windows 8 (multiple versions), and Windows 7 (multiple versions)

CVE-2021-31955 (CVSS: 5.0): Windows Kernel Information Disclosure Vulnerability

• Exploitation of this vulnerability requires previous access by the adversary; low-level privileges are required
• Impacted products include Windows Server (multiple versions) and Windows 10 (multiple versions)

CVE-2021-31955 and CVE-2021-31956 were identified and reported to Microsoft by Kaspersky. The company has stated that the vulnerabilities were exploited in highly targeted attacks against multiple organizations. In these attacks, adversaries exploited vulnerabilities in Chrome versions 89.0.4389.128 (patched April 13th) and 90.0.4430.72 (patched April 20th). Additional details on attacks are expected to emerge in the coming days. eSentire continues to investigate these issues for additional details and detection opportunities.

References:

[1] https://msrc.microsoft.com/update-guide
[2] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33739
[3] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31956
[4] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33742
[5] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31199
[6] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31201
[7] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31955
[8] https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/