Microsoft Patch Tuesday Released with 83 Fixes

There are 10 Critical and 73 Important fixes this month for Microsoft Windows, Edge (Edge HTML-based), ChakraCore, Office and Microsoft Office Services and Web Apps, Visual Studio, Microsoft Malware Protection Engine, .NET Core, ASP .NET, and Azure and another month without fixes for Internet Explorer 11.

Year 2 Extended Support approaches: Windows 7 and Windows Server 2008 (including R2) have both 5 Important vulnerabilities fixed.

Robert Brown, Head of Customer Success for Syxsense said, “This is a very reasonable sized release by Microsoft this month, which we really appreciate as everyone returns to work after the New Year holiday. We do have a Weaponised vulnerability to immediately respond to which Microsoft have confirmed is being exploited, and one which has been made Publicly Aware meaning the exact mechanism to exploit is publicly known.”

Top January Patches and Vulnerabilities

1. CCVE-2021-1647: Microsoft Defender Remote Code Execution Vulnerability

The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software. Although this should be updated automatically, if you have installed another Antivirus Solution which has disabled Microsoft Defender, it’s own update mechanism may not run and there you could still be vulnerable.

Vendor Severity: Critical
CVSS: 7.8
Weaponized: Yes
Syxscore Risk Alert:

• Attack Vector: Local
• Attack Complexity: Low
• Privileges: Low
• User Interaction: None
• Jump Point: No

2. CCVE-2021-1648: Microsoft splwow64 Elevation of Privilege Vulnerability

SPLWOW64.exe is a Windows process that runs when using 32-bit printer drivers on 64 bit Windows operating systems. Although most operating systems in use are 64bit, most legacy software will still need to use a 32bit driver.

Vendor Severity: Important
CVSS: 7.8
Publicly Aware: Yes
Syxscore Risk Alert:

• Attack Vector: Local
• Attack Complexity: Low
• Privileges: Low
• User Interaction: None
• Jump Point: No

3. CVE-2021-1691: Hyper-V Denial of Service Vulnerability

We know some organisations are using Hyper-V to setup secure stations (aka sandbox) back to corporate networks since the beginning of the lockdown. This vulnerability impacts both Window10 and Windows Server OS.

Vendor Severity: Important
CVSS: 7.7
Syxscore Risk Alert:

• Attack Vector: Local
• Attack Complexity: Low
• Privileges: Low
• User Interaction: None
• Jump Point: Yes

Syxsense Recommendations

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below which you should prioritize this month; please pay close attention to any of these which are Publicly Aware and / or Weaponized.