THE THREAT
In Microsoft’s February Patch Tuesday release, fifty-eight separate vulnerabilities received security patches. Five vulnerabilities from this release stand out as especially concerning.
Microsoft identified a zero-day vulnerability (CVE-2021-1732) impacting Windows 10 devices. The vulnerability has been exploited in the wild prior to patch release for privilege escalation. Additionally, Microsoft released fixes for multiple vulnerabilities in their implementation of TCP/IP (CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086) affecting multiple Windows products. Lastly, Microsoft patched a critical vulnerability in the Windows Fax Service (CVE-2021-24077), that could be exploited to cause remote code execution. These vulnerabilities have not been exploited in the wild at this time, but exploitation is expected in the near future.
It is recommended that organizations apply patches for all impacted products as soon as possible.
What we’re doing about it
- MVS will automatically add the relevant checks for these Microsoft vulnerabilities once details are made available
- eSentire security teams continue to track this topic for additional details and detection opportunities
What you should do about it
- Review and apply Microsoft security updates
- If patching is currently not possible, apply the Microsoft provided workarounds for CVE-2021-24074, CVE-2021-24094, CVE-2021-24086, and CVE-2021-24077
Additional information
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-1732 (CVSS:3.0 7.8)
A vulnerability exists in the core system component of Windows which could grant system level access when executed. This is a zero-day vulnerability, meaning exploitation in the wild has been identified. Exploitation requires the ability to execute code locally on a device. For a list of affected Windows versions, see Microsoft’s Update Guide.
Multiple Vulnerabilities in Windows implementation of TCP/IP
CVE-2021-24074 (CVSS:3.0 9.8)
CVE-2021-24094 (CVSS:3.0 9.8)
CVE-2021-24086 (CVSS:3.0 7.5)
Microsoft released security updates for three vulnerabilities impacting their implementation of networking TCP/IP protocols. These vulnerabilities affect all Windows versions and should be prioritized for patching or mitigated with workarounds. In their blog post, Microsoft states the vulnerabilities were discovered internally and creating working remote code execution exploits would be complex. Microsoft does warn that Denial-of-Service exploits are more likely to emerge. There is currently no known exploitation of these vulnerabilities in the wild.
Windows Fax Service Remote Code Execution Vulnerability
CVE-2021-24077 (CVSS:3.0 9.8)
A remotely exploitable vulnerability exists in Windows Fax Service. An attacker with network access to a vulnerable device can execute code. In order to exploit this vulnerability, both the Windows Fax and Scan feature and Fax service need to be enabled and running. This vulnerability was discovered by 3rd parties and technical details or proof-of-concept exploits are not public. There are no reports of in-the-wild exploits at this time. For a list of affected Windows versions see Microsoft’s Update Guide.
References:
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732
[2] https://msrc-blog.microsoft.com/2021/02/09/multiple-security-updates-affecting-tcp-ip/
[3] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24077
