Microsoft Releases October 2021 Patch Tuesday Fixes

There are 3 Critical, 67 Important and a single Low fix in this October Patch Tuesday. Fixes include Microsoft Windows and Windows components, Microsoft Edge, Azure, Office and Office Components, SharePoint Server, Microsoft Windows DNS, and the Windows 11 has its first every security patch.

Year 2 Extended Support – Windows 7 and Windows Server 2008 (including R2) have received some updates this month, with one currently Weaponized.

1. Windows 7 – 19 Important vulnerabilities fixed
2. Windows 2008 R2 – 20 Important vulnerabilities fixed

Robert Brown, Head of Customer Success for Syxsense said, “This may be the first time ever that Microsoft released updates for four end user based operating systems (Windows 7, 8.1, 10 & now 11. Over the next couple of months, we could see an increase in the number of vulnerabilities fixed breaching 100 once again. Should that be the case, careful selection of the most important vulnerabilities to resolve will be extremely important.”

Top October 2021 Patches and Vulnerabilities

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below. As usual, we recommend entering the CVE numbers below into your patch management solution and deploying as soon as possible. 

1. CVE-2021-40449: Win32k Elevation of Privilege Vulnerability

A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with elevated privileges. They can achieve this due to a boundary error within the Win32k driver in Microsoft Windows kernel.

This vulnerability was discovered by Kaspersky, therefore one may assume this may be used in the next ransomware attack if not resolved quickly.

Syxscore

• Vendor Severity: Important
• CVSS: 7.8
• Weaponized: Yes
• Public Aware: No
• Countermeasure: No

Syxscore Risk

• Attack Vector: Local
• Attack Complexity: Low
• Privileges: Low
• User Interaction: None
• Scope (Jump Point): No

2. CVE-2021-41335: Windows Kernel Elevation of Privilege Vulnerability

The vulnerability allows a local user to escalate privileges on the system because Windows does not properly impose security restrictions in Windows Kernel.

Syxscore

• Vendor Severity: Important
• CVSS: 7.8
• Weaponized: No
• Public Aware: Yes
• Countermeasure: No

Syxscore Risk

• Attack Vector: Local
• Attack Complexity: Low
• Privileges: None
• User Interaction: None
• Scope (Jump Point): No

3. CVE-2021-36970: Windows Print Spooler Spoofing Vulnerability

A remote attacker can spoof page content because the Windows Print Spooler incorrectly processes user supplied data. This vulnerability is more likely to be targeted by hackers because of the recent report of printing issues which are ongoing.

Syxscore

• Vendor Severity: Important
• CVSS: 8.8
• Weaponized: No
• Public Aware: No
• Countermeasure: No

Syxscore Risk

• Attack Vector: Network
• Attack Complexity: Low
• Privileges: None
• User Interaction: Required
• Scope (Jump Point): No

Syxsense Recommendations

Based on the vendor severity and CVSS Score, we have made a few recommendations below which you should prioritize this month. Please pay close attention to any of these which are publicly aware or weaponized.