March 2021 – Microsoft Patch Tuesday and Other Patches

Update sign and text on a computer keyboard button 3D illustration.

Microsoft has released fixes for 82 vulnerabilities, with 10 updates classified as Critical and 72 as Important. Here’s an updated announcement (2021-02-09) from Microsoft: Deploy Windows SSUs and LCUs together with one cumulative update –

Beginning with the February 2021 LCU, we will now publish all future cumulative updates and SSUs for Windows 10, version 2004 and above together as one cumulative monthly update to the normal release category in WSUS.

LCU = Latest Cummulative Update
SSU – Servicing Stack Update

UPDATE – 2021-03-14:
DYMO Label Printer fix for BSOD issues.

UPDATE – 2021-03-13:
Microsoft shares temporary fix for Windows 10 printing crashes

UPDATE – 2013-03-13:
Updates on Microsoft Exchange Server Vulnerabilities (CISA)

UPDATE – 2021-03-10:
Windows 10 KB5000802 (March) update is crashing PCs with BSOD
Windows 10 BSOD crashes include the both workstation and server versions running March 2021 cumulative updates:

  • KB5000802: Windows 10 2004/20H2 & Windows Server 2004/20H2
  • KB5000808: Windows 10 1909 & Windows Server 1909
  • KB5000822: Windows 10 1809 & Windows Server 2019
  • KB5000809: Windows 10 1803 & Windows Server 1803

Zero-Day Vulnerabilities Fixes:
1. Internet Explorer Memory Corruption Vulnerability (CVE-2021-26411)
2. Internet Explorer Remote Code Execution Vulnerability (CVE-2021-27085)
3. Windows Win32k Elevation of Privilege Vulnerability (CVE-2021-27077)
4. Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27078)

Windows 10 Updates for February 2021:

Microsoft Exchange ProxyLogon attacks

Microsoft released out-of-band security updates for the ProxyLogon vulnerability that are actively being used by threat actors worldwide to compromise Microsoft Exchange servers.

These vulnerabilities are being tracked with the following CVEs:

  • CVE-2021-26855 – Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2021-26857 – Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2021-26858 – Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2021-27065 – Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft has released security updates for currently supported Microsoft Exchange cumulative updates and older unsupported versions.

Microsoft has released a PowerShell script called Test-ProxyLogon.ps1 that will check for indicators of compromise (IOC) in Exchange HttpProxy logs, Exchange log files, and Windows Application event logs.

March 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server

Additional March 2021 Patching Resources:

On March 9, 2021 (PT), Microsoft released security updates affecting the following Microsoft products:

Product FamilyMaximum SeverityMaximum ImpactAssociated KB Articles and/or Support Webpages
Windows 10 v20H2, v2004, v1909, v1809, and v1803CriticalRemote Code ExecutionWindows 10 v2004 and Windows 10 v20H2: 5000802 Windows 10 v1909: 5000808 Windows 10 v1809: 5000822 Windows 10 v1803: 5000809
Windows Server 2019, Windows Server 2016, and Server Core installations (2019, 2016, v20H2, v2004, and v1909)CriticalRemote Code ExecutionWindows Server 2019: 5000822 Windows Server 2016: 5000803 Windows Server v2004 and Windows Server v20H2: 5000802 Windows Server v1909: 5000808
Windows 8.1, Windows Server 2012 R2, and Windows Server 2012CriticalRemote Code ExecutionWindows 8.1 and Windows Server 2012 R2 Monthly Rollup: 5000848 Windows 8.1 and Windows Server 2012 R2 Security Only: 5000853 Windows Server 2012 Monthly Rollup: 5000847 Windows Server 2012 Security Only: 5000840
Internet Explorer 11CriticalRemote Code ExecutionInternet Explorer 11 Cumulative Update: 5000800
Microsoft Office-related softwareImportantRemote Code Execution4484376, 4486673, 4493151, 4493200, 4493203, 4493214, 4493224, 4493225, 4493227, 4493228, 4493229, 4493233, 4493234, 4493239, 4504702, 4504703, 4504707
Microsoft SharePoint-related softwareImportantRemote Code Execution3101541, 4493177, 4493199, 4493230, 4493231, 4493232, 4493238
Power BI Report ServerImportantInformation Disclosure5001284, 5001285
Azure-related softwareCriticalRemote Code ExecutionFind details on security updates for Azure-related software in the Security Update Guide: https://msrc.microsoft.com/update-guide
Microsoft Visual Studio-related softwareCriticalRemote Code ExecutionFind details on security updates for Visual Studio-related software at https://docs.microsoft.com/visualstudio and in the Security Update Guide: https://msrc.microsoft.com/update-guide
Windows Admin CenterImportantSecurity Feature BypassFind details on security updates for Windows Admin Center in the Security Update Guide: https://msrc.microsoft.com/update-guide
HEVC Video ExtensionsCriticalRemote Code ExecutionFind details on security updates for HEVC Video Extensions in the Security Update Guide: https://msrc.microsoft.com/update-guide

Notes:

  • The summary above is an overview of updates for the most recent versions of commonly used software.
  • Updates for older versions, apps, and open source software may not be listed.
  • Updates may have been added or removed from the release after this content was finalized.
  • Find details for all updates in the monthly release in the Security Update Guide: https://msrc.microsoft.com/update-guide
  • For additional details, see the release notes at: https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar  

Security vulnerability overview:

Below is a summary showing the number of vulnerabilities addressed in this release, broken down by product/component and by impact.

Vulnerability DetailsRCEEOPIDSFBDOSSPFTMPPublicly DisclosedKnown ExploitMax CVSS
Windows 10 v20H2 & Windows Server v20H2112931400109.9
Windows 10 v2004 & Windows Server v2004112931400109.9
Windows 10 v1909 & Windows Server v1909112831400109.9
Windows 10 v1809 & Windows Server 2019102631400109.8
Windows 10 v180342131200108.8
Windows Server 201681731400109.8
Windows 8.1 & Server 2012 R281230400109.8
Windows Server 201281230300109.8
Internet Explorer 112000000118.8
Microsoft Office-related software7001000007.8
Microsoft SharePoint-related software1010010008.8
Power BI Report Server0010000007.7
Azure-related software2010000009.3
Microsoft Visual Studio-related software6000000008.8
Windows Admin Center0001000004.3
HEVC Video Extensions10000000007.8
RCE = Remote Code Execution | EOP = Elevation of Privilege | ID = Information Disclosure | SFB = Security Feature Bypass | DOS = Denial of Service | SPF = Spoofing | TMP = Tampering

Notes: 

  • Vulnerabilities that overlap components may be represented more than once in the table.
  • The summary above is an overview of updates for commonly used software. Updates for older versions, apps, and open source software may not be listed.
  • Updates may have been added or removed from the release after this content was finalized.
  • Find details for all updates in the monthly release in the Security Update Guide: https://msrc.microsoft.com/update-guide
  • For additional details, see the release notes at: https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar  

Resources for deploying updates to remote devices

With so many people working remotely, it is a good time to review guidance on deploying security updates to remote devices, such as desktops, laptops, and tablets. Here are some resources to answer questions pertaining to deploying updates to remote devices.

Part 1: Helping businesses rapidly set up to work securely from personal PCs and mobiles

Part 2: Helping IT send and provision business PCs at home to work securely during COVID-19

Part 3: Manage work devices at home during Covid-19 using Configuration Manager

Part 4: Managing remote machines with cloud management gateway (CMG)

Part 5: Managing Patch Tuesday with Configuration Manager in a remote work world

See also:

Mastering​ Configuration Manager Bandwidth limitations for VPN connected Clients

Vulnerability details for the current month

Below are summaries for some of the security vulnerabilities in this release. These specific vulnerabilities were selected from the larger set of vulnerabilities in the release for one or more of the following reasons: 1) We received inquiries regarding the vulnerability; 2) the vulnerability may have received attention in the trade press; or 3) the vulnerability is potentially more impactful than others in the release. Because we do not provide summaries for every vulnerability in the release, you should review the content in the Security Update Guide for information not provided in these summaries.

Notes on details in the vulnerability summaries:

Attack VectorThis metric reflects the context by which vulnerability exploitation is possible. The Base Score increases the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable component.
Attack ComplexityThis metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Such conditions may require the collection of more information about the target or computational exceptions. The assessment of this metric excludes any requirements for user interaction in order to exploit the vulnerability. If a specific configuration is required for an attack to succeed, the Base metrics should be scored assuming the vulnerable component is in that configuration.
Privileges RequiredThis metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
User InteractionThis metric captures the requirement for a user, other than the attacker, to participate in the successful compromise the vulnerable component. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.
CVE-2021-24089HEVC Video Extensions Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Score MetricsBase CVSS Score: 7.8Privileges Required: NoneConfidentiality: High
Attack Vector: LocalUser Interaction: RequiredIntegrity: High
Attack Complexity: LowScope: UnchangedAvailability: High
Affected Software:HEVC Video Extensions
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24089
CVE-2021-24090Windows Error Reporting Elevation of Privilege Vulnerability 
ImpactElevation of Privilege
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Score MetricsBase CVSS Score: 7.8Privileges Required: NoneConfidentiality: High
Attack Vector: LocalUser Interaction: RequiredIntegrity: High
Attack Complexity: LowScope: UnchangedAvailability: High
Affected Software:Windows 10 Version 20H2, Windows 10 Version 2004, Windows 10 Version 1909, Windows Server, version 20H2, Windows Server, version 2004, and Windows Server, version 1909
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24090
CVE-2021-26867Windows Hyper-V Remote Code Execution Vulnerability 
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Score MetricsBase CVSS Score: 9.9Privileges Required: LowConfidentiality: High
Attack Vector: NetworkUser Interaction: NoneIntegrity: High
Attack Complexity: LowScope: ChangedAvailability: High
Affected Software:Windows 10 Version 20H2, Windows 10 Version 2004, Windows 10 Version 1909, Windows Server, version 20H2, Windows Server, version 2004, and Windows Server, version 1909
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26867
CVE-2021-27077Windows Win32k Elevation of Privilege Vulnerability
ImpactElevation of Privilege
SeverityImportant
Publicly Disclosed?Yes
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Score MetricsBase CVSS Score: 7.8Privileges Required: LowConfidentiality: High
Attack Vector: LocalUser Interaction: NoneIntegrity: High
Attack Complexity: LowScope: UnchangedAvailability: High
Affected Software:All supported versions of Windows
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27077
CVE-2021-26897Windows DNS Server Remote Code Execution Vulnerability 
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Score MetricsBase CVSS Score: 9.8Privileges Required: NoneConfidentiality: High
Attack Vector: NetworkUser Interaction: NoneIntegrity: High
Attack Complexity: LowScope: UnchangedAvailability: High
Affected Software:Windows Server, version 20H2, Windows Server, version 2004, Windows Server, version 1909, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2012
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26897
CVE-2021-26411Internet Explorer Memory Corruption Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?Yes
Known Exploits?Yes
ExploitabilityExploitation detected
CVSS Score MetricsBase CVSS Score: 8.8Privileges Required: NoneConfidentiality: Low
Attack Vector: NetworkUser Interaction: RequiredIntegrity: High
Attack Complexity: LowScope: ChangedAvailability: Low
Affected Software:Internet Explorer 11 on Windows 10 Version 20H2, Windows 10 Version 2004, Windows 10 Version 1909, Windows 10 Version 1809, Windows 10 Version 1803, Windows 8.1, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2012 and Microsoft Edge (EdgeHTML-based) on Windows 10 Version 20H2, Windows 10 Version 2004, Windows 10 Version 1909, Windows 10 Version 1809, Windows 10 Version 1803, Windows Server 2019, and Windows Server 2016
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26411
CVE-2021-27076Microsoft SharePoint Server Remote Code Execution Vulnerability 
ImpactRemote Code Execution
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Score MetricsBase CVSS Score: 8.8Privileges Required: LowConfidentiality: High
Attack Vector: NetworkUser Interaction: NoneIntegrity: High
Attack Complexity: LowScope: UnchangedAvailability: High
Affected Software:Microsoft SharePoint Foundation 2013, Business Productivity Servers 2010, SharePoint Server 2019, and SharePoint Enterprise Server 2016
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27076     
CVE-2021-27053Microsoft Excel Remote Code Execution Vulnerability 
ImpactRemote Code Execution
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Score MetricsBase CVSS Score: 7.8Privileges Required: NoneConfidentiality: High
Attack Vector: LocalUser Interaction: RequiredIntegrity: High
Attack Complexity: LowScope: UnchangedAvailability: High
Affected Software:Microsoft Office 2019, Office Online Server, 365 Apps for Enterprise, Excel 2016, Excel 2013, Excel 2010, and Office Web Apps Server 2013
More Information:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27053

February 2021 – Microsoft Patch Tuesday and Other Patches

Microsoft has released fixes for 56 vulnerabilities, with 11 updates classified as Critical and 43 as Important. Here’s an updated announcement (2021-02-09) from Microsoft: Deploy Windows SSUs and LCUs together with one cumulative update –

Beginning with the February 2021 LCU, we will now publish all future cumulative updates and SSUs for Windows 10, version 2004 and above together as one cumulative monthly update to the normal release category in WSUS.

LCU = Latest Cummulative Update
SSU – Servicing Stack Update

UPDATE – 2021-02-21
KB4301818 > KB5001078

UPDATE – 2021-02-17
KB4577586

Windows 10 Updates for February 2021:

  • KB4601319 (OS Builds 19041.804 and 19042.804) for Windows 10 version 20H2 / 2004
  • KB4601315 (OS Build 18363.1377) for Windows 10, version 1909
  • KB5001028 (OS Build 18363.1379) Out-of-band for Windows 10, version 1909
  • KB4601345 (OS Build 17763.1757) for Windows 10 version 1809
  • KB4601354 (OS Build 17134.2026) for Windows 10 version 1803
  • KB4601330 (OS Build 15063.2642) for Windows 10 version 1703
  • KB4601318 (OS Build 14393.4225) for Windows 10 version 1607
  • KB4601331 (OS Build 10240.18842) for Windows 10, initial release

Additional February 2021 Patching Resources:

Patched publicly disclosed vulnerabilities:

  • CVE-2021-1721 – .NET Core and Visual Studio Denial of Service Vulnerability
  • CVE-2021-1727 – Windows Installer Elevation of Privilege Vulnerability
  • CVE-2021-1733 – Sysinternals PsExec Elevation of Privilege Vulnerability
  • CVE-2021-24098 – Windows Console Driver Denial of Service Vulnerability
  • CVE-2021-24106 – Windows DirectX Information Disclosure Vulnerability
  • CVE-2021-26701 – .NET Core Remote Code Execution Vulnerability

Intel microcode updates for Windows:

Microsoft has also released Intel microcode updates for Windows 10 20H2, 2004, 1909, and older versions to fix issues impacting current and previously released Windows 10 versions.

These microcode updates are offered to affected devices via Windows Update but they can also be manually downloaded directly from the Microsoft Catalog using these links:

  • KB4589212: Intel microcode updates for Windows 10, version 2004 and 20H2, and Windows Server, version 2004 and 20H2
  • KB4589211: Intel microcode updates for Windows 10, version 1903 and 1909, and Windows Server, version 1903 and 1909
  • KB4589208: Intel microcode updates for Windows 10, version 1809 and Windows Server 2019
  • KB4589206: Intel microcode updates for Windows 10, version 1803
  • KB4589210: Intel microcode updates for Windows 10, version 1607 and Windows Server 2016
  • KB4589198: Intel microcode updates for Windows 10, version 1507

On February 9, 2021, Microsoft released security updates affecting the following Microsoft products:

Product FamilyMaximum SeverityMaximum ImpactAssociated KB Articles and/or Support Webpages
Windows 10 v20H2, v2004, v1909, v1809, and v1803CriticalRemote Code ExecutionWindows 10 v2004 and Windows 10 v20H2: 4601319 Windows 10 v1909: 4601315 Windows 10 v1809: 4601345 Windows 10 v1803: 4601354
Windows Server 2019, Windows Server 2016, and Server Core installations (2019, 2016, v20H2, v2004, and v1909)CriticalRemote Code ExecutionWindows Server 2019: 4601345 Windows Server 2016: 4601318 Windows Server v2004 and Windows Server v20H2: 4601319 Windows Server v1909: 4601315
Windows 8.1, Windows Server 2012 R2, and Windows Server 2012CriticalRemote Code ExecutionWindows 8.1 and Windows Server 2012 R2 Monthly Rollup: 4601384 Windows 8.1 and Windows Server 2012 R2 Security Only: 4601349 Windows Server 2012 Monthly Rollup: 4601348 Windows Server 2012 Security Only: 4601357
Microsoft Office-related softwareImportantRemote Code Execution4493211, 4493222, 4493196, 4493192, 4493204
Microsoft SharePoint-related softwareImportantRemote Code Execution4493210, 4493194, 4493195, 4493223
Microsoft Lync/Skype for BusinessImportantDenial of Service5000675, 5000688
Microsoft Exchange ServerImportantSpoofing4602269, 4571787
Microsoft .NET-related softwareCriticalRemote Code Execution4601318, 4601050, 4601887, 4603004, 4602960, 4603005, 4602961, 4601354, 4601056, 4603003, 4602959, 4603002, 4602958, 4601051, 4601054
Microsoft Visual StudioImportantRemote Code ExecutionFind details on security updates for Visual Studio-related software in the Security Update Guide: https://msrc.microsoft.com/update-guide
Microsoft Dynamics-related softwareImportantInformation Disclosure4602915
Microsoft Azure-related softwareImportantElevation of PrivilegeFind details on security updates for Azure-related software in the Security Update Guide: https://msrc.microsoft.com/update-guide
Developer toolsImportantRemote Code ExecutionFind details on security updates for developer tools in the Security Update Guide: https://msrc.microsoft.com/update-guide

Notes:

Security vulnerability overview:

Below is a summary showing the number of vulnerabilities addressed in this release, broken down by product/component and by impact.

Vulnerability DetailsRCEEOPIDSFBDOSSPFTMPPublicly DisclosedKnown ExploitMax CVSS
Windows 10 v20H2 & Windows Server v20H210752400319.8
Windows 10 v2004 & Windows Server v200410752400319.8
Windows 10 v1909 & Windows Server v190910652300319.8
Windows 10 v1809 & Windows Server 201910752300319.8
Windows 10 v18037642300319.8
Windows Server 201610531200109.8
Windows 8.1 & Server 2012 R27430200109.8
Windows Server 20127430200109.8
Microsoft Office-related software4000000007.8
Microsoft SharePoint-related software2010010008.8
Lync/Skype for Business0000110006.5
Microsoft Exchange Server0000020006.5
Microsoft .NET-related software2000200008.1
Microsoft Visual Studio-related software2000100107.8
Microsoft Dynamics-related software0010010006.5
Microsoft Azure-related software0200000007.0
Developer tools1100000007.8
RCE = Remote Code Execution | EOP = Elevation of Privilege | ID = Information Disclosure | SFB = Security Feature Bypass | DOS = Denial of Service | SPF = Spoofing | TMP = Tampering

Resources for deploying updates to remote devices:

Part 1: Helping businesses rapidly set up to work securely from personal PCs and mobiles
Part 2: Helping IT send and provision business PCs at home to work securely during COVID-19
Part 3: Manage work devices at home during Covid-19 using Configuration Manager
Part 4: Managing remote machines with cloud management gateway (CMG)
Part 5: Managing Patch Tuesday with Configuration Manager in a remote work world

See also:
Mastering​ Configuration Manager Bandwidth limitations for VPN connected Clients

Vulnerability details for the current month:

Below are summaries for some of the security vulnerabilities in this release:

Attack VectorThis metric reflects the context by which vulnerability exploitation is possible. The Base Score increases the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable component.
Attack ComplexityThis metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Such conditions may require the collection of more information about the target or computational exceptions. The assessment of this metric excludes any requirements for user interaction in order to exploit the vulnerability. If a specific configuration is required for an attack to succeed, the Base metrics should be scored assuming the vulnerable component is in that configuration.
Privileges RequiredThis metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
User InteractionThis metric captures the requirement for a user, other than the attacker, to participate in the successful compromise the vulnerable component. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.
CVE-2021-1727Windows Installer Elevation of Privilege Vulnerability
ImpactElevation of Privilege
SeverityImportant
Publicly Disclosed?Yes
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1727
CVE-2021-1732Windows Win32k Elevation of Privilege Vulnerability
ImpactElevation of Privilege
SeverityImportant
Publicly Disclosed?No
Known Exploits?Yes
ExploitabilityExploitation detected
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareWindows 10 v20H2, Windows 10 v2004, Windows 10 v1909, Windows 10 v1809, Windows 10 v1803, Windows Server v20H2, Windows Server v2004, Windows Server v1909, and Windows Server 2019
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732
CVE-2021-24074Windows TCP/IP Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Base Score9.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24074
CVE-2021-24094Windows TCP/IP Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Base Score9.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24094
CVE-2021- 24077Windows Fax Service Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score9.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24077
CVE-2021-24078Windows DNS Server Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Base Score9.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareWindows Server v20H2, Windows Server v2004, Windows Server v1909, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2012
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24078
CVE-2021-24088Windows Local Spooler Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityCritical
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score8.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareAll supported versions of Windows
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24088
CVE-2021-24098Windows Console Driver Denial of Service Vulnerability
ImpactDenial of Service
SeverityImportant
Publicly Disclosed?Yes
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score5.5
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Affected SoftwareWindows 10 v20H2, Windows 10 v2004, Windows 10 v1909, Windows 10 v1809, Windows 10 v1803, Windows Server v20H2, Windows Server v2004, Windows Server v1909, and Windows Server 2019
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24098
CVE-2021-24066Microsoft SharePoint Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation more likely
CVSS Base Score8.8
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareMicrosoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Foundation 2013 Service Pack 1, and Microsoft SharePoint Foundation 2010 Service Pack 2
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24066
CVE-2021-24067Microsoft Excel Remote Code Execution Vulnerability
ImpactRemote Code Execution
SeverityImportant
Publicly Disclosed?No
Known Exploits?No
ExploitabilityExploitation less likely
CVSS Base Score7.8
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected SoftwareMicrosoft 365 Apps for Enterprise, Excel 2016, Excel 2013, Excel 2010, Office Online Server, Office 2019, Office 2019 for Mac, and Office Web Apps Server 2013
More Informationhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24067 

February 2021 Microsoft Office security updates

Microsoft Office security updates are delivered through the Microsoft Update platform and via the Download Center.

Patched Office security vulnerabilities – (Source: Bleeping Computer)

This month’s Office security updates address bugs exposing Windows systems running vulnerable Click to Run and Microsoft Installer (.msi) based editions of Microsoft Office products to remote code execution (RCE), information disclosure, and spoofing attacks.

Microsoft rated the six RCE bugs patched in February 2021 as Important severity issues given that they could enable attackers to execute arbitrary code in the context of the currently logged-in user.

Following successful exploitation, attackers could install malicious programs, view, change, and delete data, as well as make their own admin accounts on exploited Windows devices.

TagCVE IDCVE TitleSeverity
Microsoft Office ExcelCVE-2021-24067Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft Office ExcelCVE-2021-24068Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft Office ExcelCVE-2021-24069Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft Office ExcelCVE-2021-24070Microsoft Excel Remote Code Execution VulnerabilityImportant
Microsoft Office SharePointCVE-2021-24071Microsoft SharePoint Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2021-1726Microsoft SharePoint Spoofing VulnerabilityImportant
Microsoft Office SharePointCVE-2021-24066Microsoft SharePoint Remote Code Execution VulnerabilityImportant
Microsoft Office SharePointCVE-2021-24072Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant

Further information about each of them is available within the knowledge base articles linked below.

Microsoft Office 2016:

ProductKnowledge Base article title and number
Excel 2016Description of the security update for Excel 2016: February 9, 2021 (KB4493196)
Office 2016February 2, 2021, update for Office 2016 (KB4493189)
Outlook 2016February 2, 2021, update for Outlook 2016 (KB4493190)
PowerPoint 2016February 2, 2021, update for PowerPoint 2016 (KB4493164)

Microsoft Office 2013:

ProductKnowledge Base article title and number
Excel 2013Description of the security update for Excel 2013: February 9, 2021 (KB4493211)
Office 2013February 2, 2021, update for Office 2013 (KB4486684)
PowerPoint 2013February 2, 2021, update for PowerPoint 2013 (KB4493169)

Microsoft Office 2010:

ProductKnowledge Base article title and number
Excel 2010Description of the security update for Excel 2010: February 9, 2021 (KB4493222)
Office 2010February 2, 2021, update for Office 2010 (KB4493180)
PowerPoint 2010February 2, 2021, update for PowerPoint 2010 (KB4493179)

Microsoft SharePoint Server 2019:

ProductKnowledge Base article title and number
Office Online ServerDescription of the security update for Office Online Server: February 9, 2021 (KB4493192)
SharePoint Server 2019Description of the security update for SharePoint Server 2019: February 9, 2021 (KB4493194)
SharePoint Server 2019 Language PackFebruary 9, 2021, update for SharePoint Server 2019 Language Pack (KB4493193)

Microsoft SharePoint Server 2016:

ProductKnowledge Base article title and number
SharePoint Enterprise Server 2016Description of the security update for SharePoint Enterprise Server 2016: February 9, 2021 (KB4493195)

Microsoft SharePoint Server 2013:

ProductKnowledge Base article title and number
Office Web Apps Server 2013Description of the security update for Office Web Apps Server 2013: February 9, 2021 (KB4493204)
Project Server 2013February 9, 2021, cumulative update for Project Server 2013 (KB4493207)
SharePoint Enterprise Server 2013February 9, 2021, cumulative update for SharePoint Enterprise Server 2013 (KB4493209)
SharePoint Foundation 2013Description of the security update for SharePoint Foundation 2013: February 9, 2021 (KB4493210)
SharePoint Foundation 2013February 9, 2021, cumulative update for SharePoint Foundation 2013 (KB4493205)

Microsoft SharePoint Server 2010:

ProductKnowledge Base article title and number
Project Server 2010February 9, 2021, update for Project Server 2010 (KB4475537)
Project Server 2010February 9, 2021, cumulative update for Project Server 2010 (KB4493217)
SharePoint Foundation 2010Description of the security update for SharePoint Foundation 2010: February 9, 2021 (KB4493223)
SharePoint Server 2010February 9, 2021, cumulative update for SharePoint Server 2010 (KB4493220)
SharePoint Server 2010February 9, 2021, update for SharePoint Server 2010 (KB4493212)
SharePoint Server 2010 Office Web AppsFebruary 9, 2021, update for SharePoint Server 2010 Office Web Apps (KB4493219)

Windows 7 Network Controller Issues – KB4338818 (July 2018)

The July 2018 Windows Updates for Windows 7 SP1 and Windows Server 2008 R2 SP1 introduces a bug that could cause the network interface controller to stop working. The update referenced is KB4338818.

In case your systems run into this issue, the workaround from Microsoft is to do the following:

Please use your best judgement and evaluate the risks of applying this update to your Windows 7 SP1 and Windows Server 2008 R2 systems.

** Update **
According to an IT Pro who opened a support case with Microsoft, this is the information provided at this time:

“Regarding the known issue in the July monthly rollup about the network interface controller that will stop working. We are still looking at the data gathered from multiple customers and we do not have a list third party software that is causing the issue. What we do know until now, is that the issue is reproducing mainly on VM over VMware.”

Microsoft Security Updates Guide (Portal)

For the last 20 years, Microsoft has provided security bulletins as individual web pages which were available from the Microsoft Security Bulletin website, and January 10, 2017 was the last time this was made available. Going forward starting in February 2017, the new Security Update Guide portal will provide the security information via a dashboard. Knowledge Base (KB) number, CVE number, vulnerability, Windows version, or date of release can be searched on the online Security Update Guide (SUG) database.

According the the blogpost by the MSRC Team, using the new portal, you can:

  • Sort and filter security vulnerability and update content, for example, by CVE, KB number, product, or release date.
  • Filter out products that don’t apply to you, and drill down to more detailed security update information for products that do.
  • Leverage a new RESTful API to obtain Microsoft security update information. This eliminates the need for you to employ outdated methods like screen-scraping of security bulletin web pages to assemble working databases of necessary and actionable information.

If you have any feedback, you can send them to: [email protected].

Follow me (@Hoorge) on Twitter and join Tech Konnect on Facebook and Twitter (@TechKonnect) to stay current on technology related matters.

Windows 10 Version 1607 Media Now Available

Windows 10, version 1607 was declared the Current Branch for Business (CBB) on November 29, 2016. The updated media for Windows 10 v1607 (Windows 10 Anniversary Update) is now available on Windows Update for Business (WUB), Windows Server Update Services (WSUS), and MSDN. Volume Licensing Service Center (VLSC) customers will receive the updated Windows 10 v1607 media on January 26, 2017.

FYI – No further action is needed if you have already installed the December cumulative update (KB3201845), or the most current cumulative update (CU), as that system is already running the CBB release.

Follow me (@Hoorge) on Twitter and join Tech Konnect on Facebook and Twitter (@TechKonnect) to stay current on technology related matters.

How To Fix: Bitlocker Recovery Key Prompts On Every Reboot

windows-10-bitlocker-featured

There are few reports of users having Bitlocker issues following the October 2016 patches.

The issue: On every reboot, the Bitlocker recovery key is required which is quite disruptive and cumbersome. As a workaround in order to solve this issue, the following steps can be taken:

On the next reboot and once in Windows, reset Bitlocker by disabling and re-enabling it.
In administraive command prompt, do the following:
manage-bde -protectors c:-disable
then do this:
manage-bde -protectors c:-enable

At this time, I’m not certain on which patch is causing the issue but I wanted to share this info to help. You can also discuss in this TechNet post.

Follow (@Hoorge) on Twitter and join Tech Konnect on Facebook and Twitter (@TechKonnect) to stay current on technology related matters.

Updated – Microsoft Update Catalog Site

new-ms-update-catalog

The Microsoft Windows team mentioned on August 15, 2016 that they were working on releasing an updated version of the Microsoft Update Catalog which would eliminate the need for ActiveX requirements in order for the site to work in any browser.

The Microsoft Update Catalog website is being updated to remove the ActiveX requirement so it can work with any browser. Currently, Microsoft Update Catalog still requires that you use Internet Explorer. We are working to remove the ActiveX control requirement, and expect to launch the updated site soon.

Good news! As of yesterday, the site has been updated and you can now access the Microsoft Update Catalog site using any browser including Edge, Google Chrome, and others with the following URL: http://www.catalog.update.microsoft.com. Here’s the blog post by Michael Niehaus with the announcement.

Follow (@Hoorge) on Twitter and join Tech Konnect on Facebook and Twitter (@TechKonnect) to stay current on technology related matters.

System Center Operations Manager (SCOM) Console Crash

scom-gsx-solutions

** UPDATE**
(October 19, 2016)
A fix for the SCOM console crash issue as previously blogged below has been released. See the following KB320006 article to obtain the hotfix.

***************************************************************************************************

**Posted on October 18, 2016**

There is a widespread report of System Center Operations Manager (SCOM) 2012 R2 / 2016 console crashes due to some bugs in October 2016 Cummulative Updates, in particular with the following patches: KB3194798 / KB3192392 / KB3185330 / KB3185331.

The product team has acknowledged the issue on their blog post and is said to be working on releasing a fix soon. The current recommendation is to uninstall the problematic patches as a temporary workaround. According to the blog post, an announcement will be made on the SCOM Team blog when a fix has been made available. So, keep a close eye on it.

Links related to this post:

SCOM Product Team Console Issue Ackowledgement
TechNet Discussion
SCOM Product Team Blog
Microsoft Tech Community Discussion

Follow (@Hoorge) on Twitter and join Tech Konnect on Facebook and Twitter (@TechKonnect) to stay current on technology related matters.

How To Reset WSUS Server

3d human try to press a button

Sometimes, for various reasons, one must perform a WSUS reset function to make the WSUS server happy again. The reset process forces a resync of each update in the WSUS server with Microsoft services. This task can take a long time to complete as each update will be re-evaluated and re-downloaded, so be patient.

Here’s the command to run from an administrator command prompt::
%SystemDrive%\Program Files\Update Services\Tools\WsusUtil.exe reset

Follow (@Hoorge) on Twitter and join Tech Konnect on Facebook to stay current on technology related matters.