Windows Update April 2021 Edition
Patch Tuesday includes updates patching 110 vulnerabilities, of which 88 are important and 19 critical. There are 19 Elevation of Privilege, 17 Information Disclosures, 55 Remote Code Executions, 9 Denial of Service, 6 Security Feature Bypass, and 2 Spoofing Vulnerabilities patched with this update.
Some of the most interesting patches are yet another update of the Microsoft Exchange server. Some of these vulnerabilities were brought to you courtesy of the NSA rating the high end of the CVSS rating system at 9.8 each. The other two rank 8.8 and 9.0 respectively. All Four of the vulnerabilities that affect the Microsoft Exchange server are considered critical Remote Code Execution vulnerabilities, but also are labeled to include High Compromise in Confidentiality, Integrity, and Availability of the affected product. These Microsoft Exchange server vulnerabilities are addressed in CVE-2021-28480(9.8), CVE-2021-28481(9.8), CVE-2021-28482(8.8), and CVE-2021-28483(9.0). These affect Microsoft Exchange server versions 2013, 2016, and 2019.
The CISA has issued an alert to Patch Microsoft Exchange Servers Immediately and wishes to clarify these patches are in ADDITION to the Patches from last month and are just as dangerous, but just have not been exploited yet.
The update patch for Windows 10 does have some interesting updates. One update includes a patch which “(a)ddresses an issue in which a principal in a trusted MIT realm fails to obtain a Kerberos service ticket from Active Directory domain controllers … This occurs on devices that installed Windows Updates that contain CVE-2020-17049 protections and configured PerformTicketSignature to 1 or higher. These updates were released between November 10, 2020 and December 8, 2020. Ticket acquisition also fails with the error, “KRB_GENERIC_ERROR”, if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without providing the USER_NO_AUTH_DATA_REQUIRED flag.”
Another patch resolves an issue in CVE-2020-1036 brought up by a security researcher concerning the RemoteFX vGPU feature and this patch actually deprecates the feature. Microsoft if wanting to use vGPU use the Secure vGPU feature that is included in the Discrete Device Assignment (DDA) in Windows Servers 2016 and 2019.
An elevation of privilege vulnerability addressed in CVE-2021-27092 This is an Azure Active directory Web sign-in vulnerability which “allows arbitrary browsing from the third-party endpoints used for federated authentication”.
CVE-2021-28310 is a “Win32k Elevation of Privilege Vulnerability” in the Windows Desktop Manager discovered by Boris Larin of Kaspersky which is currently being exploited in the wild with a CVSS score of 7.8. This vulnerability is an out of bounds write vulnerability in the Desktop Windows Manager that allows an attacker “to write controlled data at a controlled offset using DirectComposition API. DirectComposition is a Windows component that was introduced in Windows 8 to enable bitmap composition with transforms, effects and animations, with support for bitmaps of different sources (GDI, DirectX, etc.) ”. Full writeup of this vulnerability is in Boris’ blog post here.
There are a total of 27 Vulnerabilties in the Remote Procedure Call Runtime with 15 Important and 12 Critical Impacts listed. All of these vulnerabilities are remotely exploitable and all have a CVSS score of 8.8. A remote attacker maybe able to make a specially crafted RPC request that allows for Remote Code Execution on the targeted machine. It is possible that the higher Criticality levels of these RPC vulnerabilities are for higher privileged access, though it is unclear due to the description of these vulnerabilities provided by Microsoft. Microsoft has listed Yuki Chen as the security researcher who found 26 of the 27 vulnerabilities.
A couple of Windows Media decoder vulnerabilities in CVE-2021-27095 and CVE-2021-28315 allow for an attack to host a specially crafted website and trick a user into visiting it to exploit these vulnerabilities. These vulnerabilities rank a 7.8 on the CVSS rating system. These Vulnerabilities were discovered by yangkang(@dnpushme)
There is an Azure Active Directory Web Sign-in vulnerability addressed in CVE-2021-27092 “Addresses a potential elevation of privilege vulnerability in the way Azure Active Directory web sign-in allows arbitrary browsing from the third-party endpoints used for federated authentication.” This vulnerability has been assigned a CVSS score of 6.8.
Other windows component updates include Microsoft Office, SharePoint, DNS Server, Microsoft Edge (Chromium), Windows Speech, Windows Diagnostics Hub, Visual Studio, AppX Deployment Extensions, Event Tracing, Windows Installer, Windows Kernel, Windows Resource Manager, Portmapping, Registry, Remote Procedure Call Runtime, NTFS, Network Files System (NFS), SMB, and TCP/IP.
Microsoft removed the old Microsoft Edge web browser in this update, if it hasn’t already been removed and installed the new Microsoft edge in its place.
Also a note, if you are using Windows 10 version 1909 it goes end of life next month at the next windows update Patch Tuesday. So, may be a good time to upgrade your version 1909 to the latest version of windows 20H2.
Sources:
https://krebsonsecurity.com/2021/04/microsoft-patch-tuesday-april-2021-edition/
https://msrc.microsoft.com/update-guide/releaseNote/2021-Apr
https://msrc.microsoft.com/update-guide/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28481
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28480
https://www.ghacks.net/2021/04/13/microsoft-windows-security-updates-april-2021-overview/
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1036
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28310
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28315
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27095
https://msrc-blog.microsoft.com/2021/04/13/april-2021-update-tuesday-packages-now-available/
https://msrc-blog.microsoft.com/2021/04/13/april-2021-update-tuesday-packages-now-available/
https://securityaffairs.co/wordpress/116767/uncategorized/exchange-server-flaws-nsa.html
https://www.tomsguide.com/news/microsoft-patch-tuesday-april-21