Weekly threat roundup: Chrome, Exchange Server, IoT devices

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Fixes for two Chrome zero-days under attack

Google has patched its Chrome web browser on Windows, Mac, and Linux with fixes for high-risk two vulnerabilities that are being actively exploited.

The two flaws are CVE-2021-21220, which is based on insufficient validation of untrusted input in the V8 JavaScript rendering engine, and CVE-2021-21206, which is a use-after-free bug in the Blink browser engine. Hackers are exploiting these two flaws to execute code in a victim’s web browser, but depending on the privileges tied with the browser, an attacker could also view, change, or delete data.

The former vulnerability was demonstrated by Dataflow Security researchers Bruno Keith and Niklas Baumstark at the Pwn2Own 2021 hacking contest, while an anonymous researcher has been credited with reporting the latter flaw to Google.

NSA find new Exchange Server vulnerabilities 

Microsoft has released patches for four newly discovered vulnerabilities in its Exchange Server systems only a few weeks after hackers were revealed to be exploiting Exchange Server bugs to target mostly on-premise data centres.

The flaws, which aren’t related to the initial attacks, apply to versions 2013, 2016, and 2019 of the operating system, and were discovered by the US National Security Agency (NSA). They include CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, and CVE-2021-28483. All four are remote code execution flaws, while the first two are pre-authentication in nature, meaning an attacker won’t need to authenticate to a vulnerable Exchange server to exploit.

The most severe is rated 9.8/10 on the CVSS threat severity scale, while another critically-rated flaw is rated 9/10, and the least severe is rated 8.8/10.

Desktop Window Manager exploit among Patch Tuesday fixes

Related Resource

The definitive guide to IT security

Protecting your MSP and your customers

The definitive guide to IT security for MSPs - whitepaper from LiongardDownload now

Alongside the four Exchange Server vulnerabilities, Microsoft this week released more than a hundred fixes across its product portfolio, including one for an actively exploited flaw in Desktop Window Manager.

Tracked as CVE-2021-28310, this escalation of privilege flaw is likely being used in a chain alongside other exploits to seize control of victims’ devices. The flaw is an out-of-bounds write vulnerability in dwmcore.dll, which is part of the Desktop Window Manager executable, according to researchers with Kaspersky’s SecureList. It's allowed attackers to execute arbitrary code, create accounts with full privileges, access or delete data and install software.

Microsoft patched 19 critical flaws and 88 tagged as being important as part of its latest wave of Patch Tuesday updates, including the four previously mentioned Exchange Server vulnerabilities.

Millions of IoT devices at risk

Nine vulnerabilities in four TCP/IP communication protocols commonly used by millions of Internet of Things (IoT) devices may lead to denial of service (DoS) or remote code execution attacks.

More than 100 million consumer and industrial IoT devices are potentially affected by the ‘Name:Wreck’ flaws, according to Forescout and JSOF researchers. The nine vulnerabilities affect the FreeBSD, Nucleus NET, IPnet, and NetX TCP/IP stacks, relating to Domain Name System (DNS) implementations, which means attackers can exploit the flaws to knock target devices offline or take complete control over them.

The researchers have recommended that developers of TCP/IP stacks review their code for any bugs and immediately fix them. FreeBSD, Nucleus NET and NetX have recently been patched, so customers should update their IoT devices immediately in order to fully protect themselves against exploitation.

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021