March Patch Tuesday 2021 Addresses 89 Security Fixes

Microsoft Fixes 89 Bugs this Month, Including Critical IE Fix

There are 14 critical and 75 important fixes this month. This includes updates for Windows, Azure and Azure DevOps, Azure Sphere, Internet Explorer and Edge (EdgeHTML), Exchange Server, Office and Office Services and Web Apps, SharePoint Server, Visual Studio, and Windows Hyper-V.

Year 2 Extended Support – Windows 7 and Windows Server 2008 (including R2) also received updates:

• Windows 7 – 5 Important vulnerabilities fixed, with the most important one fixing an issue with pending print jobs which remain in an error state.
• Windows 2008 R2 – 1 Critical and 8 Important vulnerabilities fixed, with the worst impacting DNS as per our recommendation below.

“Today is the last scheduled release of patches for legacy Windows Edge, and going forward this will become an obsolete browser,” said Robert Brown, Head of Customer Success for Syxsense. “ You must upgrade to the newest Microsoft Edge browser which uses the new Chromium engine, similar to Mozilla and Google Chrome.”

For next month, the only updates for Microsoft Edge will be for the Chromium version. We have also seen a very serious weaponized issue fixed with Internet Explorer which has not been patched for almost four months.

Top March Patches and Vulnerabilities

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below. As usual, we recommend entering the CVE numbers below into your patch management solution and deploying as soon as possible.

1. CVE-2021-26411: Internet Explorer Memory Corruption Vulnerability

An attacker could host a specially crafted website designed to exploit the vulnerability through Internet Explorer and convince a user to view the website. Additionally, the attacker could also take advantage of compromised websites, or ones that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability.

However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.

Syxscore

• Vendor Severity: Critical
• CVSS: 8.8
• Weaponised: Yes
• Public Aware: Yes
• Countermeasure: No

Syxscore Risk Alert

• Attack Vector: Network
• Attack Complexity: Low
• Privileges: None
• User Interaction: Required
• Scope (Jump Point): Yes

2. CVE-2021-26867: Hyper-V Remote Code Execution Vulnerability

Microsoft Windows Hyper-V could allow a remote authenticated attacker to execute arbitrary code on the system. By executing a specially-crafted program on a Hyper-V guest, an attacker could exploit this vulnerability to execute arbitrary code on the host operating system.

Syxscore

• Vendor Severity: Critical
• CVSS: 9.9
• Weaponised: No
• Public Aware: No
• Countermeasure: Hyper-V client which is configured to use the Plan 9 file system, under Linux.

Syxscore Risk Alert

• Attack Vector: Network
• Attack Complexity: Low
• Privileges: Low
• User Interaction: None
• Scope (Jump Point): Yes

3. CVE-2021-26897: Windows DNS Server Remote Code Execution Vulnerability

The vulnerability exists due to improper input validation in the Windows DNS Server. A remote attacker can send a specially-crafted request and execute arbitrary code on the target system which if success may result in complete compromise of vulnerable system.

Syxscore

• Vendor Severity: Critical
• CVSS: 9.8
• Weaponised: No
• Public Aware: No
• Countermeasure: Some – DNS server would need to have dynamic updates enabled.

Syxscore Risk Alert

• Attack Vector: Network
• Attack Complexity: Low
• Privileges: None
• User Interaction: None
• Scope (Jump Point): No

Syxsense Recommendations

Based on the vendor severity and CVSS Score, we have made a few recommendations below which you should prioritize this month. Please pay close attention to any of these which are publicly aware or weaponized.

Experience the Power of Syxsense

Syxsense is a cloud-based solution that helps organizations manage and secure their endpoints with ease. Automatically deploy OS and third-party patches as well as Windows 10 Feature Updates for Microsoft, Mac, and Linux devices.