January 2021 – Microsoft Patch Tuesday and Other Patches

Microsoft has released fixes for 83 vulnerabilities, with ten updates classified as Critical and 73 as Important.

Windows 10 Updates for January 2021:

  • KB4598242 (OS Builds 19041.746 and 19042.746) for Windows 10 version 20H2/2004
  • KB4598229 (OS Build 18363.1316) for Windows 10, version 1909
  • KB4598230 (OS Build 17763.1697) for Windows 10 version 1809
  • KB4598245 (OS Build 17134.1967) for Windows 10 version 1803
  • KB4599208 (OS Build 15063.2614) for Windows 10 version 1703
  • KB4598243 (OS Build 14393.4169) for Windows 10 version 1607
  • KB4598231 (OS Build 10240.18818) for Windows 10, initial release

Additional January 2021 Patching Resources:

On January 12, 2021 (Pacific Time), Microsoft released security updates affecting the following Microsoft products:

Product FamilyMaximum SeverityMaximum ImpactAssociated KB Articles and/or Support Webpages
Windows 10 v20H2, v2004, v1909, v1809, and v1803CriticalRemote Code ExecutionWindows 10 v2004 and Windows 10 v20H2: 4598242 Windows 10 v1909: 4598229 Windows 10 v1809: 4598230 Windows 10 v1803: 4598245
Windows Server 2019, Windows Server 2016, and Server Core installations (2019, 2016, v20H2, v2004, v1909)CriticalRemote Code ExecutionWindows Server 2019: 4598230 Windows Server 2016: 4598243 Windows Server v2004 and Windows Server v20H2: 4598242 Windows Server v1909: 4598229
Windows 8.1, Windows Server 2012 R2, and Windows Server 2012CriticalRemote Code ExecutionWindows 8.1 and Windows Server 2012 R2 Monthly Rollup: 4598285 Windows 8.1 and Windows Server 2012 R2 Security Only: 4598275 Windows Server 2012 Monthly Rollup: 4598278 Windows Server 2012 Security Only: 4598297
Microsoft Office-related softwareImportantRemote Code ExecutionKB Articles associated with Microsoft Office-related software: 4493156, 4486736, 4486755, 4486759, 4486762, 4486764, 4493142, 4493143, 4493145, 4493160, 4493165, 4493168, 4493171, 4493176, 4493181, 4493183, and 4493186
Microsoft SharePoint-related softwareImportantRemote Code ExecutionKB Articles associated with Microsoft SharePoint-related software: 4486683, 4486724, 4493161, 4493162, 4493163, 4493167, 4493175, 4493178, and 4493187
Microsoft .NET-related softwareImportantDenial of ServiceFind details on security updates for .NET Framework-related software in the Security Update Guide: https://msrc.microsoft.com/update-guide
Microsoft SQL Server-related softwareImportantElevation of PrivilegeKB Articles associated with Microsoft SQL Server-related software: 4583456, 4583457, 4583458, 4583459, 4583460, 4583461, 4583462, 4583463, and 4583465
Microsoft Visual Studio-related softwareImportantRemote Code ExecutionKB Articles associated with Microsoft Visual Studio-related software: 4584787
Microsoft Malware Protection EngineCriticalRemote Code ExecutionFind details for security updates for the Microsoft Malware Protection Engine in the Security Update Guide: https://msrc.microsoft.com/update-guide

Notes:

  • The summary above is an overview of updates for the most recent versions of commonly used software.
  • Updates for older versions, apps, and open source software may not be listed.
  • Updates may have been added or removed from the release after this content was finalized.
  • Find details for all updates in the monthly release in the Security Update Guide: https://msrc.microsoft.com/update-guide
  • For additional details, see the release notes at: https://msrc.microsoft.com/update-guide/releaseNote/2021-Jan  

Security vulnerability overview:

Below is a summary showing the number of vulnerabilities addressed in this release, broken down by product/component and by impact.

Vulnerability DetailsRCEEOPIDSFBDOSSPFTMPPublicly DisclosedKnown ExploitMax CVSS
Windows 10 v20H2 & Windows Server v20H21331106200108.8
Windows 10 v2004 & Windows Server v20041331106200108.8
Windows 10 v1909 & Windows Server v1909133086200108.8
Windows 10 v1809 & Windows Server 2019133086100108.8
Windows 10 v1803133076100108.8
Windows Server 2016132775200108.8
Windows 8.1 & Server 2012 R2131764200108.8
Windows Server 2012131752100108.8
Microsoft Office-related software5000000007.8
Microsoft SharePoint-related software4200021008.8
Microsoft SQL Server-related software0100000008.8
Microsoft Visual Studio-related software1200100007.8
Microsoft .NET-related software0000100007.5
Microsoft Malware Protection Engine1000000017.8
RCE = Remote Code Execution | EOP = Elevation of Privilege | ID = Information Disclosure | SFB = Security Feature Bypass | DOS = Denial of Service | SPF = Spoofing | TMP = Tampering

Notes: 

  • Vulnerabilities that overlap components may be represented more than once in the table.
  • The summary above is an overview of updates for commonly used software. Updates for older versions, apps, and open source software may not be listed.
  • Updates may have been added or removed from the release after this content was finalized.
  • Find details for all updates in the monthly release in the Security Update Guide: https://msrc.microsoft.com/update-guide
  • For additional details, see the release notes at: https://msrc.microsoft.com/update-guide/releaseNote/2021-Jan  

Resources for deploying updates to remote devices:

With so many people working remotely, it is a good time to review guidance on deploying security updates to remote devices, such as desktops, laptops, and tablets. Here are some resources to answer questions pertaining to deploying updates to remote devices.

Part 1: Helping businesses rapidly set up to work securely from personal PCs and mobiles
Part 2: Helping IT send and provision business PCs at home to work securely during COVID-19
Part 3: Manage work devices at home during Covid-19 using Configuration Manager
Part 4: Managing remote machines with cloud management gateway (CMG)
Part 5: Managing Patch Tuesday with Configuration Manager in a remote work world

See also:
Mastering​ Configuration Manager Bandwidth limitations for VPN connected Clients

Vulnerability details for the current month:

Below are summaries for some of the security vulnerabilities in this release. These specific vulnerabilities were selected from the larger set of vulnerabilities in the release for one or more of the following reasons: 1) We received inquiries regarding the vulnerability; 2) the vulnerability may have received attention in the trade press; or 3) the vulnerability is potentially more impactful than others in the release. Because we do not provide summaries for every vulnerability in the release, you should review the content in the Security Update Guide for information not provided in these summaries.

Notes on details in the vulnerability summaries:

Attack VectorThis metric reflects the context by which vulnerability exploitation is possible. The Base Score increases the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable component.
Attack ComplexityThis metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Such conditions may require the collection of more information about the target or computational exceptions. The assessment of this metric excludes any requirements for user interaction in order to exploit the vulnerability. If a specific configuration is required for an attack to succeed, the Base metrics should be scored assuming the vulnerable component is in that configuration.
Privileges RequiredThis metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
User InteractionThis metric captures the requirement for a user, other than the attacker, to participate in the successful compromise the vulnerable component. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.
CVE-2021-1674Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability
ImpactSecurity Feature Bypass
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score8.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1674
CVE-2021-1673Remote Procedure Call Runtime Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score8.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1673
CVE-2021-1643HEVC Video Extensions Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareHEVC Video Extensions
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1643
CVE-2021-1648Microsoft splwow64 Elevation of Privilege Vulnerability
ImpactElevation of Privilege
SeverityImportant
Publicly Disclosed?Yes
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1648
CVE-2021-1665GDI+ Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1665
CVE-2021-1705Microsoft Edge (HTML-based) Memory Corruption Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score4.2
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityNone
Affected SoftwareMicrosoft Edge (EdgeHTML-based)
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1705
CVE-2021-1707Microsoft SharePoint Server Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Base Score8.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareMicrosoft SharePoint Foundation 2013, SharePoint Foundation 2010, SharePoint Server 2019, and SharePoint Enterprise Server 2016
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1707
CVE-2021-1714Microsoft Excel Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareMicrosoft Excel 365 Apps for Enterprise, Excel Services, Excel 2010, Excel 2013, Excel 2016, Office 2010, Office 2013, Office 2016, Office 2019, Office 2019 for Mac, Office Online Server, Office Web Apps Server 2013, and Office SharePoint Enterprise Server 2013.
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1714
CVE-2021-1715Microsoft Word Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareMicrosoft Excel 365 Apps for Enterprise, Word 2010, Word 2013, Word 2016, Office 2010, Office 2019, Office 2019 for Mac, Office Online Server, Office Web Apps 2010, Office Web Apps Server 2013, Office SharePoint Enterprise Server 2013, SharePoint Enterprise Server 2016, SharePoint Server 2010, and SharePoint Server 2019 
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1715
CVE-2021-1636Microsoft SQL Elevation of Privilege Vulnerability
ImpactElevation of Privilege
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score8.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareMicrosoft SQL Server 2012, SQL Server 2014, SQL Server 2016, SQL Server 2017, and SQL Server 2019
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1636
CVE-2021-1647Microsoft Defender Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?Yes
ExploitabilityExploitation detected
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareMicrosoft Security Essentials, System Center 2012 R2, System Center Endpoint Protection, Windows Defender
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1647 

Disclosure: Source for the info below:

List of patched Office security vulnerabilities

Office security updates published as part of the January 2021 Patch Tuesday address bugs exposing Windows systems running vulnerable Click to Run and Microsoft Installer (.msi)-based editions of Microsoft Office products to remote code execution (RCE) attacks.

Microsoft rated the six RCE bugs patched this month as Important severity issues since they could enable attackers to execute arbitrary code in the context of the currently logged-in user.

TagCVE IDCVE TitleSeverity
Microsoft OfficeCVE-2021-1713Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2021-1714Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2021-1711Microsoft Office Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2021-1715Microsoft Word Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2021-1716Microsoft Word Remote Code Execution VulnerabilityImportant
Microsoft Office SharePointCVE-2021-1712Microsoft SharePoint Elevation of Privilege VulnerabilityImportant
Microsoft Office SharePointCVE-2021-1707Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant
Microsoft Office SharePointCVE-2021-1718Microsoft SharePoint Server Tampering VulnerabilityImportant
Microsoft Office SharePointCVE-2021-1717Microsoft SharePoint Spoofing VulnerabilityImportant
Microsoft Office SharePointCVE-2021-1719Microsoft SharePoint Elevation of Privilege VulnerabilityImportant
Microsoft Office SharePointCVE-2021-1641Microsoft SharePoint Spoofing VulnerabilityImportant

January 2021 Microsoft Office security updates

Microsoft Office security updates are delivered through the Microsoft Update platform and via the Download Center.

Further information about each of them is available within the knowledge base articles linked below.

To download the January 2021 Microsoft Office security updates, you have to click on the corresponding knowledge base article below and then scroll down to the ‘How to download and install the update‘ section.

Microsoft Office 2016

ProductKnowledge Base article title and number
Excel 2016Security update for Excel 2016 (KB4493165)
Office 2016Security update for Office 2016 (KB4493168)
Office 2016Security update for Office 2016 (KB4486755)
Word 2016Security update for Word 2016 (KB4493156)


Microsoft Office 2013

ProductKnowledge Base article title and number
Excel 2013Security update for Excel 2013 (KB4493176)
Office 2013Security update for Office 2013 (KB4486762)
Office 2013Security update for Office 2013 (KB4486759)
Word 2013Security update for Word 2013 (KB4486764)


Microsoft Office 2010

ProductKnowledge Base article title and number
Excel 2010Security update for Excel 2010 (KB4493186)
Office 2010Security update for Office 2010 (KB4493143)
Office 2010Security update for Office 2010 (KB4493142)
Office 2010Security update for Office 2010 (KB4493181)
Word 2010Security update for Word 2010 (KB4493145)


Microsoft SharePoint Server 2019

ProductKnowledge Base article title and number
Office Online ServerSecurity update for Office Online Server (KB4493160)
SharePoint Server 2019Security update for SharePoint Server 2019 (KB4493162)
SharePoint Server 2019 Language PackSecurity update for SharePoint Server 2019 Language Pack (KB4493161)


Microsoft SharePoint Server 2016

ProductKnowledge Base article title and number
SharePoint Enterprise Server 2016Security update for SharePoint Enterprise Server 2016 (KB4493163)
SharePoint Enterprise Server 2016Security update for SharePoint Enterprise Server 2016 (KB4493167)


Microsoft SharePoint Server 2013

ProductKnowledge Base article title and number
Office Web Apps Server 2013Security update for Office Web Apps Server 2013 (KB4493171)
Project Server 2013Cumulative update for Project Server 2013 (KB4493173)
SharePoint Enterprise Server 2013Security update for SharePoint Enterprise Server 2013 (KB4486724)
SharePoint Enterprise Server 2013Security update for SharePoint Enterprise Server 2013 (KB4486683)
SharePoint Enterprise Server 2013Cumulative update for SharePoint Enterprise Server 2013 (KB4493150)
SharePoint Foundation 2013Security update for SharePoint Foundation 2013 (KB4493175)
SharePoint Foundation 2013Cumulative update for SharePoint Foundation 2013 (KB4493172)


Microsoft SharePoint Server 2010

ProductKnowledge Base article title and number
Project Server 2010Cumulative update for Project Server 2010 (KB4493182)
SharePoint Foundation 2010Security update for SharePoint Foundation 2010 (KB4493187)
SharePoint Server 2010Security update for SharePoint Server 2010 (KB4493178)
SharePoint Server 2010Security update for SharePoint Server 2010 (KB4486736)
SharePoint Server 2010Cumulative update for SharePoint Server 2010 (KB4493184)
SharePoint Server 2010 Office Web AppsSecurity update for SharePoint Server 2010 Office Web Apps (KB4493183)

Cisco AnyConnect VPN Error – “The file ‘Manifest Tool.exe’ is not marked for installation”

anyconnectwin_reconnect2

Problem:
Error: “The file ‘Manifest Tool.exe’ is not marked for installation” occurs during installation of Cisco AnyConnect client. This generally happens due to a failed upgrade installation of the client..

Solution:
Uninstall any version of the Cisco AnyConnect VPN client if it exist on the system.
Then, edit the registry by following these steps:

  • Launch the Registry Editor by typing “regedit” in the search window or box.
  • If a dialogue box pops up displaying the following: “Do you want to allow the following program to make changes to this computer?”, Click Yes.
  • Browse to the following location: HKEY_CLASSES_ROOT\Installer\Products\
  • Within the Products folder, locate and delete the registry key which contains the product information for Cisco AnyConnect.
    1. Go through each key in the Products folder until you find the one for Cisco AnyConnect. For example, the registry key for Cisco AnyConnect is named {D5BA4DB6420F33A4BAA83AD8BF69D037}
    2. Please note that the version of Cisco AnyConnect that you have may display a different registry key name.
  • Close the registry editor.
  • Install the Cisco AnyConnect client.

** Please make a backup of the registry before deleting or modifying any keys.