December Patch Tuesday 2021 Fixes 67 Vulnerabilities

December Patch Tuesday Arrives with 67 Fixes

There are 7 Critical (one more than last month) and 60 Important fixes in this release.  Updates were included for Microsoft Windows and Windows Components, ASP.NET Core and Visual Studio, Azure Bot Framework SDK, Internet Storage Name Service, Defender for IoT, Edge (Chromium-based), Microsoft Office and Office Components, SharePoint Server, PowerShell, Remote Desktop Client, Windows Hyper-V, Windows Mobile Device Management and Windows Remote Access.

Year 2 Extended Support – Windows 7 and Windows Server 2008 (including R2) have received some updates this month. We are really close to the need to review for a third and final year of ESU if you are still using Windows 7 or 2008.

Robert Brown, Head of Customer Success for Syxsense said,“There are many extremely high risk vulnerabilities this month, with one being weaponized. Six other vulnerabilities are Publicly Aware meaning the exact method to exploit is public knowledge, and with some of these being recognized by Microsoft as Exploit More Likely, this is not what our customers wants to hear going into the end of year and Holiday Season.”

Top December Patches and Vulnerabilities

Based on the Vendor Severity & CVSS Score, we have made a few recommendations below.  As usual we recommend our customers enter the CVE numbers below into your Patch Management solution and deploy as soon as possible.

1. CVE-2021-43890: Windows AppX Installer Spoofing Vulnerability

It has been linked to attacks associated with the Emotet/TrickBot/Bazaloader family. The vulnerability exists due to incorrect permissions in the windows installer service.  A local user can run a specially-crafted program to execute arbitrary code with SYSTEM privileges.

Syxscore

• Vendor Severity: Critical
• CVSS: 7.1
• Weaponized: Yes
• Public Aware: Yes
• Countermeasure: Yes

 Syxscore Risk

• • Attack Vector: Network
  • Attack Complexity: High
  • Privileges: Low
  • User Interaction: Required
  • Scope (Jump Point): No

2. CVE-2021-43905: Microsoft Office App Remote Code Execution Vulnerability

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system. A remote attacker can send a specially-crafted request and execute arbitrary code on the target system because of an improper input validation in Microsoft Office app.

Microsoft have suggested this vulnerability is Exploitation More Likely and with the threat of a Jump Point, this vulnerability can be used to hop into the OS and jump into another technology. This is an extremely serious vulnerability to resolve.

Syxscore

• Vendor Severity: Critical
• CVSS: 9.6
• Weaponized: No
• Public Aware: No
• Countermeasure: No 

Syxscore Risk

• Attack Vector: Network
• Attack Complexity: Low
• Privileges: None
• User Interaction: Required
• Scope (Jump Point): Yes

3. CVE-2021-43217: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability

The vulnerability exists due to a boundary error when processing untrusted input in Windows Encrypting File System (EFS). The Encrypted File System, or EFS, provides an additional level of security for files and directories. It provides cryptographic protection of individual files on NTFS file system volumes using a public-key system. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

Syxscore

• Vendor Severity: Critical
• CVSS: 8.1
• Weaponized: No
• Public Aware: Yes
• Countermeasure: No

Syxscore Risk

• Attack Vector: Network
• Attack Complexity: High
• Privileges: None
• User Interaction: None
• Scope (Jump Point): No

Syxsense Recommendations

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below which you should prioritize this month; please pay close attention to any of these which are Publicly Aware and / or Weaponized.