Weekly threat roundup: Microsoft, Adobe, Wi-Fi gadgets

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, we have collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Microsoft patches three zero-days 

A zero-day flaw in the beleaguered Exchange Server platform was among the 55 vulnerabilities Microsoft fixed as part of its latest Patch Tuesday round of security updates.

The flaw, tracked as CVE-2021-31207, is present in the same platform that was at the heart of a devastating supply chain attack earlier in the year, although it hasn’t yet been exploited by cyber criminals. It’s described as a security feature bypass flaw and was discovered as part of last month’s Pwn2Own contest.

This has been fixed alongside two other zero-day vulnerabilities. These are an elevation of privilege flaw in .NET and Visual Studio, tagged CVE-2021-31204, and a remote code execution flaw in Microsoft's Common Utilities component, tagged CVE-2021-31200.

Adobe fixes Reader bug under attack

Adobe’s Patch Tuesday included multiple fixes for 12 different products, including a zero-day flaw in Adobe Reader that’s under attack.

CVE-2021-28550, in Adobe Reader, is a user after free bug that has led to reports of remote code execution attacks against Windows users. However, the bug also affects Adobe deployments on macOS machines, although exploitation hasn’t yet been detected. This vulnerability was fixed alongside bugs in Adobe Experience Manager, InDesign, InCopy, Genuine Service, Acrobat, Magento, Media Encoder, After Effects, Medium, Animate, and the Creative Cloud Desktop.

Of the 14 flaws, 11 could have been exploited to launch remote code execution attacks, while the other three were described as a memory leak, arbitrary file system read and privilege escalation flaw.

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastDownload now

WordPress patches critical object injection flaw

WordPress has fixed a critical vulnerability with version 5.7.2 that’s been described as an object injection flaw in PHPMailer, which is a code library used to send emails using PHP code from a web server.

Rated 9.8 on the CVSS threat severity scale, the flaw, known as CVE-2020-36326, could have allowed an attacker to perform a variety of attacks, such as code injection, SQL injection and denial of service. This would have put many websites at risk of compromise.

For WordPress users who haven’t updated to 5.7, all versions since 3.7 have also been updated automatically to fix the security flaw.

“Frag attacks” targeting Wi-Fi devices

Millions of Wi-Fi devices manufactured over the last 20 years are embedded with vulnerabilities that hackers can exploit to steal data or take control of smart home devices.

According to security researcher Mathy Vanhoef, “frag attacks” are present in the Wi-Fi Protected Access 3 (WPA3) protocol, which is the most up-to-date Wi-Fi security protocol available. To exploit the collection of design flaws, an attacker within radio range of a targeted device can inject frames into a protected network, which can be abused to intercept traffic, by, for instance, tricking the user into using a malicious DNS server.

There are 12 vulnerabilities in total. Vanhoef has informed the Wi-Fi Alliance of his discovery of these “frag attacks., and device manufacturers are now developing fixes, according to the Industry Consortium for Advancement of Security on the Internet (ICASI).

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Recommended

ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021
Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
CISOs aren’t leading by example when it comes to cyber security
cyber security

CISOs aren’t leading by example when it comes to cyber security

24 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

Best paying tech jobs of 2021
Careers & training

Best paying tech jobs of 2021

7 Jun 2021
Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021
Mythic launches power-sipping AI chip
Hardware

Mythic launches power-sipping AI chip

8 Jun 2021