Security

Microsoft Patch Tuesday security updates for November 2021 fix 2 Zero-Days actively exploited

Microsoft Patch Tuesday security updates for November 2021 address 55 vulnerabilities in multiple products and warn of two actively exploited issues.

Microsoft Patch Tuesday security updates for November 2021 addressed a total of 55 vulnerabilities in Microsoft Windows and Windows Components, Azure, Azure RTOS, Azure Sphere, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Microsoft Office and Office Components, Windows Hyper-V, Windows Defender, and Visual Studio.

The IT giant also confirmed that two vulnerabilities in Microsoft Exchange Server and Microsoft Excel are actively exploited.

“We are aware of limited targeted attacks in the wild using one of vulnerabilities (CVE-2021-42321), which is a post-authentication vulnerability in Exchange 2016 and 2019. Our recommendation is to install these updates immediately to protect your environment.” read the announcement published by Microsoft. “These vulnerabilities affect on-premises Microsoft Exchange Server, including servers used by customers in Exchange Hybrid mode. Exchange Online customers are already protected and do not need to take any action.”

Six of the issues fixed by Microsoft are rated Critical and 49 are rated as Important in severity. Four of these vulnerabilities have been reported through the ZDI program.

“Historically speaking, 55 patches in November is a relatively low number. Last year, there were more than double this number of CVEs fixed. Even going back to 2018 when there were only 691 CVEs fixed all year, there were more November CVEs fixed than in this month.” reads the post published by Zero Day Initiative.

The actively exploited vulnerabilities addressed by Microsoft this month are:

CVE-2021-42321 – Microsoft Exchange Server Remote Code Execution Vulnerability – The flaw is a remote code execution issue that occurs due to improper validation of cmdlet arguments. Microsoft pointed out that the flaw can be exploited only by an authenticated attacker.

CVE-2021-42292 – Microsoft Excel Security Feature Bypass Vulnerability – This vulnerability is a code execution issue that can be triggered by an attacker tricking the victims into opening a specially crafted file with an affected version of Excel. The flaw affects Microsoft Office for macOS but the company has yet to fix the issue for Apple’s platform.

Microsoft also addressed four other publicly disclosed vulnerabilities:

  • CVE-2021-38631 – Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
  • CVE-2021-41371 – Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
  • CVE-2021-43208 – 3D Viewer Remote Code Execution Vulnerability
  • CVE-2021-43209 – 3D Viewer Remote Code Execution Vulnerability

The complete list of vulnerabilities addressed this month is available here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Operation Cyclone)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Czech Republic accuses China’s APT31 of a cyberattack on its Foreign Ministry

The Czech government condemned China after linking cyber espionage group APT31 to a cyberattack on…

11 hours ago

New PumaBot targets Linux IoT surveillance devices

PumaBot targets Linux IoT devices, using SSH brute-force attacks to steal credentials, spread malware, and…

15 hours ago

App Store Security: Apple stops $2B in fraud in 2024 alone, $9B over 5 years

Apple blocked over $9B in fraud in 5 years, including $2B in 2024, stopping scams…

16 hours ago

Crooks use a fake antivirus site to spread Venom RAT and a mix of malware

Researchers found a fake Bitdefender site spreading the Venom RAT by tricking users into downloading…

20 hours ago

Iranian Man pleaded guilty to role in Robbinhood Ransomware attacks<gwmw style="display:none;"></gwmw>

Iranian man pleads guilty to role in Baltimore ransomware attack tied to Robbinhood, admitting to…

21 hours ago

DragonForce operator chained SimpleHelp flaws to target an MSP and its customers

Sophos warns that a DragonForce ransomware operator chained three vulnerabilities in SimpleHelp to target a…

1 day ago