Skip to main content
Patch ManagementPatch Tuesday

February Patch Tuesday 2021 Fixes 56 Vulnerabilities

By February 9, 2021June 22nd, 2022No Comments
February Patch Tuesday 2021

February Patch Tuesday 2021 Fixes 56 Flaws and Windows Zero-Day

The second Patch Tuesday of 2021 has arrived — tackle the latest Microsoft updates and vulnerabilities for the month of February.

[vc_empty_space]
[vc_single_image image=”364589″ img_size=”full”]

Microsoft February 2021 Patch Tuesday Resolves 56 Vulnerabilities

Microsoft fixed 56 bugs this month — the first time this number has dropped under 60 in over a year.

There are 11 Critical, 43 Important, and 2 Moderate patches. Fixes this month are for:

  • .NET Framework
  • Azure IoT
  • Azure Kubernetes Service
  • Microsoft Edge for Android
  • Exchange Server
  • Office and Office Services and Web Apps
  • Skype for Business and Lync
  • Windows Defender

Second Year of Extended Support Starts

Windows 7 and Windows Server 2008 (including R2) have 2 Critical and 3 Important vulnerabilities fixed.

Robert Brown, Head of Customer Success for Syxsense said, “With a release of 59 fixes, a total of 10 of these are either Weaponized, Public Aware, or have an extremely high CVSS score rating, which some experts, including our own, would rank as Zero Day status. Never have we seen Microsoft release almost 20% of their fixes to tackle such high-severity vulnerabilities. If you expected an easy Patch Tuesday, think again — these must be deployed urgently.”

Top February Patches and Vulnerabilities

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below. As usual, we recommend our customers enter the CVE numbers below into your patch management solution and deploy as soon as possible.

1. CVE-2021-1732: Windows Win32k Elevation of Privilege Vulnerability

The bug was exploited after attackers gained access to a Windows system in order to obtain SYSTEM-level access. This vulnerability has already been Weaponized and is being recommended as a high priority deployment by CISA Cybersecurity & Infrastructure Security Agency.

Syxscore

  • Vendor Severity: Important
  • CVSS: 7.8
  • Weaponized: Yes
  • Public Aware: No
  • Countermeasure: No

Syxscore Risk Alert

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: None
  • Scope (Jump Point): No

2. CVE-2021-26701: Multiple Vulnerabilities in Microsoft .NET Core and Visual Studio

The vulnerability exists due to insufficient validation of user-supplied input in .NET Core. A remote attacker can pass specially-crafted input to the application and execute arbitrary code on the target system.

Syxscore

  • Vendor Severity: Critical
  • CVSS: 8.1
  • Weaponized: No
  • Public Aware: Yes
  • Countermeasure: No

Syxscore Risk Alert

  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges: None
  • User Interaction: None
  • Scope (Jump Point): No

3. CVE-2021-24078 Windows DNS Server Remote Code Execution Vulnerability

This patch fixes a bug in the Windows DNS Server that could allow remote code execution on affected systems. This is also potentially wormable, although only between DNS servers. The vulnerability exists due to insufficient validation of user-supplied input in Windows DNS Server.

Syxscore

  • Vendor Severity: Critical
  • CVSS: 9.8
  • Weaponized: No
  • Public Aware: No
  • Countermeasure: No

Syxscore Risk Alert

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: None
  • Scope (Jump Point): No
[vc_single_image image=”38151″ img_size=”full” onclick=”custom_link” link=”https://www.syxsense.com/start-a-free-trial-of-syxsense/”]

Syxsense Recommendations

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below which you should prioritize this month. Please pay close attention to any of these which are Publicly Aware and / or Weaponized.

CVE Reference Description Vendor Severity CVSS Score Countermeasure Publicly Aware Weaponized Syxsense Recommended
CVE-2021-1732 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No Yes Yes
CVE-2021-26701 .NET Core and Visual Studio Remote Code Execution Vulnerability Critical 8.1 No Yes No Yes
CVE-2021-1733 Sysinternals PsExec Elevation of Privilege Vulnerability Important 7.8 No Yes No Yes
CVE-2021-1727 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No Yes No Yes
CVE-2021-1721 .NET Core and Visual Studio Denial of Service Vulnerability Important 6.5 No Yes No Yes
CVE-2021-24098 Windows Console Driver Denial of Service Vulnerability Important 5.5 No Yes No Yes
CVE-2021-24106 Windows DirectX Information Disclosure Vulnerability Important 5.5 No Yes No Yes
CVE-2021-24078 Windows DNS Server Remote Code Execution Vulnerability Critical 9.8 No No No Yes
CVE-2021-24077 Windows Fax Service Remote Code Execution Vulnerability Critical 9.8 Yes No No Yes
CVE-2021-24074 Windows TCP/IP Remote Code Execution Vulnerability Critical 9.8 Yes No No Yes
CVE-2021-24094 Windows TCP/IP Remote Code Execution Vulnerability Critical 9.8 No No No Yes
CVE-2021-24093 Windows Graphics Component Remote Code Execution Vulnerability Critical 8.8 No No No Yes
CVE-2021-24088 Windows Local Spooler Remote Code Execution Vulnerability Critical 8.8 No No No Yes
CVE-2021-24066 Microsoft SharePoint Remote Code Execution Vulnerability Important 8.8 No No No
CVE-2021-24072 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No No
CVE-2021-1728 System Center Operations Manager Elevation of Privilege Vulnerability Important 8.8 No No No
CVE-2021-24105 Package Managers Configurations Remote Code Execution Vulnerability Important 8.4 No No No
CVE-2021-24112 .NET Core for Linux Remote Code Execution Vulnerability Critical 8.1 No No No
CVE-2021-1722 Windows Fax Service Remote Code Execution Vulnerability Critical 8.1 Yes No No
CVE-2021-1726 Microsoft SharePoint Spoofing Vulnerability Important 8 No No No
CVE-2021-24081 Microsoft Windows Codecs Library Remote Code Execution Vulnerability Critical 7.8 No No No
CVE-2021-24091 Windows Camera Codec Pack Remote Code Execution Vulnerability Critical 7.8 No No No
CVE-2021-24092 Microsoft Defender Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-24067 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-24068 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-24069 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-24070 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-26700 Visual Studio Code npm-script Extension Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-24083 Windows Address Book Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-24102 Windows Event Tracing Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-24103 Windows Event Tracing Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-24096 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-25195 Windows PKU2U Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-1698 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-24111 .NET Framework Denial of Service Vulnerability Important 7.5 No No No
CVE-2021-1734 Windows Remote Procedure Call Information Disclosure Vulnerability Important 7.5 No No No
CVE-2021-24086 Windows TCP/IP Denial of Service Vulnerability Important 7.5 Yes No No
CVE-2021-24087 Azure IoT CLI extension Elevation of Privilege Vulnerability Important 7 No No No
CVE-2021-1639 Visual Studio Code Remote Code Execution Vulnerability Important 7 No No No
CVE-2021-24075 Windows Network File System Denial of Service Vulnerability Important 6.8 No No No
CVE-2021-24109 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability Moderate 6.8 No No No
CVE-2021-24101 Microsoft Dataverse Information Disclosure Vulnerability Important 6.5 No No No
CVE-2021-24085 Microsoft Exchange Server Spoofing Vulnerability Important 6.5 No No No
CVE-2021-24099 Skype for Business and Lync Denial of Service Vulnerability Important 6.5 No No No
CVE-2021-24073 Skype for Business and Lync Spoofing Vulnerability Important 6.5 No No No
CVE-2021-24080 Windows Trust Verification API Denial of Service Vulnerability Moderate 6.5 No No No
CVE-2021-1724 Microsoft Dynamics Business Central Cross-site Scripting Vulnerability Important 6.1 No No No
CVE-2021-24114 Microsoft Teams iOS Information Disclosure Vulnerability Important 5.7 No No No
CVE-2021-24076 Microsoft Windows VMSwitch Information Disclosure Vulnerability Important 5.5 No No No
CVE-2021-1731 PFX Encryption Security Feature Bypass Vulnerability Important 5.5 No No No
CVE-2021-24079 Windows Backup Engine Information Disclosure Vulnerability Important 5.5 No No No
CVE-2021-24084 Windows Mobile Device Management Information Disclosure Vulnerability Important 5.5 No No No
CVE-2021-1730 Microsoft Exchange Server Spoofing Vulnerability Important 5.4 No No No
CVE-2021-24071 Microsoft SharePoint Information Disclosure Vulnerability Important 5.3 No No No
CVE-2021-24100 Microsoft Edge for Android Information Disclosure Vulnerability Important 5 No No No
CVE-2021-24082 Microsoft PowerShell Utility Module WDAC Security Feature Bypass Vulnerability
[vc_separator css=”.vc_custom_1552427883977{padding-top: 20px !important;padding-bottom: 20px !important;}”]

Experience the Power of Syxsense

Syxsense is a cloud-based solution that helps organizations manage and secure their endpoints with ease. Automatically deploy OS and third-party patches as well as Windows 10 Feature Updates for Microsoft, Mac, and Linux devices.

[vc_btn title=”Start a Free Trial” style=”gradient-custom” gradient_custom_color_1=”#da4453″ gradient_custom_color_2=”#8a2387″ shape=”round” size=”lg” align=”center” link=”url:https%3A%2F%2Fwww.syxsense.com%2Fstart-a-free-trial-of-syxsense%2F|||” css=”.vc_custom_1586908107967{margin-top: 15px !important;}”][vc_separator css=”.vc_custom_1552427883977{padding-top: 20px !important;padding-bottom: 20px !important;}”]

Leave a Reply