Microsoft Fixes New Bugs this Month, Including Public Aware & Weaponized Threats

There are 19 Critical, 88 Important and 1 Moderate — fixes this month are for Microsoft Windows, Edge, Azure and Azure DevOps Server, Microsoft Office, SharePoint Server, Hyper-V, Team Foundation Server, Visual Studio, and Exchange Server.

Year 2 Extended Support: Windows 7 and Windows Server 2008 (including R2) have received substantial updates this month surpassing all records since Windows 7 and 2008 ending their mainstream support.

1. Windows 7 – 14 Critical and 36 Important vulnerabilities fixed
2. Windows 2008 R2 – 14 Critical and 33 Important vulnerabilities fixed

Robert Brown, Head of Customer Success for Syxsense said, “We have the largest Patch Tuesday release of the year and there are many very serious issues being addressed. We understand a lot of our customers will be concerned because of the reported Blue Screen / Stop Screens caused by the March Patch Tuesday, but we implore our customers to plan the remediation of these latest threats. Your patching strategy should include testing to provide the confidence of side wide remediation.”

Top April Patches and Vulnerabilities

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below. As usual, we recommend entering the CVE numbers below into your patch management solution and deploying as soon as possible.

1. CVE-2021-28310 Win32k Elevation of Privilege Vulnerability

The vulnerability exists due to a boundary error within win32k.sys driver in Microsoft Windows. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with elevated privileges.

Syxscore

• Vendor Severity: Important
• CVSS: 7.8
• Weaponized: Yes
• Public Aware: No
• Countermeasure: No 

Syxscore Risk Alert

• Attack Vector: Local
• Attack Complexity: Low
• Privileges: Low
• User Interaction: None
• Scope (Jump Point): No

2. CVE-2021-28480 Microsoft Exchange Server Remote Code Execution

The vulnerability exists due to improper input validation in the Microsoft Exchange Server. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Syxscore

• Vendor Severity: Critical
• CVSS: 9.8
• Weaponized: No
• Public Aware: No
• Countermeasure: No

Syxscore Risk Alert

• Attack Vector: Network
• Attack Complexity: Low
• Privileges: None
• User Interaction: None
• Scope (Jump Point): No

3. CVE-2021-27091 RPC Endpoint Mapper Service Elevation of Privilege Vulnerability

The vulnerability exists due to application does not properly impose security restrictions in the RPC Endpoint Mapper Service, which leads to security restrictions bypass and privilege escalation.

Syxscore

• Vendor Severity: Important
• CVSS: 7.8
• Weaponized: No
• Public Aware: Yes
• Countermeasure: No 

Syxscore Risk Alert

• Attack Vector: Local
• Attack Complexity: Low
• Privileges: Low
• User Interaction: None
• Scope (Jump Point): No