Exchange Server zero-day among latest Microsoft Patch Tuesday fixes
The firm has patched three zero-day vulnerabilities across its products that haven’t yet been exploited
Microsoft has patched 55 vulnerabilities across a swathe of its products as part of its latest round of Patch Tuesday fixes, including three zero-day vulnerabilities that haven’t yet been publicly exploited.
The most alarming of the flaws, tracked as CVE-2021-31207, is present in the Microsoft Exchange Server platform, which was at the heart of a devastating supply chain attack earlier in the year.
This vulnerability is a security feature bypass flaw and was discovered as part of last month’s Pwn2Own contest. Although it hasn’t been exploited by cyber criminals, details of the exploitation demonstrated in the contest will be published soon.
The Exchange Server flaw has been patched alongside CVE-2021-31204, an elevation of privilege vulnerability in .NET and Visual Studio, as well as CVE-2021-31200, a remote code execution flaw in the Common Utilities component.
Four of the flaws patched as part of the 55 are classed as ‘critical’, and none of them are the three zero-days highlighted. These include remote code execution flaws in HTTP.sys, Windows OLE Automation and Hyper-V, as well as a scripting engine memory corruption bug in Internet Explorer.
The 55 CVEs patched in May represents the smallest wave of Patch Tuesday fixes so far in 2021, after more than 100 were addressed this time last month. This wave included patches for five zero-days vulnerabilities and four critical Microsoft Exchange Server flaws discovered by the NSA.
RELATED RESOURCE
The most serious of the five zero-days included CVE-2021-28310, an escalation of privilege flaw in the Desktop Window Manager component of Windows 10 that was likely being used in a chain alongside other vulnerabilities to seize control of machines.
Although CVE-2021-31207, patched this month, is deemed as less likely to be exploited, cyber criminals will be working hard to reverse engineer an exploit from the fix released this week.
The fact that details around a successful exploitation, as demonstrated in the Pwn2Own contest, could be published soon too, should urge businesses to patch their vulnerable systems as soon as possible.
-
SaaS-pocalypse now?ITPro Podcast Geopolitical uncertainty is intensifying public and private sector focus on true sovereign workloads
-
Forescout and Netskope partner to bolster zero trust securityNews The new integration combines Forescout’s device intelligence with Netskope’s private access controls to extend zero trust across enterprise environments
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Two Fortinet vulnerabilities are being exploited in the wild – patch nowNews Arctic Wolf and Rapid7 said security teams should act immediately to mitigate the Fortinet vulnerabilities
-
Everything you need to know about Google and Apple’s emergency zero-day patchesNews A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
