Patchday December 2021

If you haven't spent the last few days in a locked cave, you will have heard about the recently disclosed vulnerability in the Java vulnerability "log4j". And of course this vulnerability also dominated the patchday. But there were also other updates. Here is an overview:

‍

CVE-2021-44228: LOG4SHELL (LOG4J)

Affected products are still being identified and range from web services like Apache Struts to games like Minecraft to banking and financial applications. If you run a server based on open source software, there is a good chance you are affected by this vulnerability. Trend Micro has published this blog detailing the flaw and providing IOCs and guidance on how to detect attacks. So far, we are seeing active exploits dropping Mirai variants and Kinsing coin miners on affected servers.

We can help you identify and close affected vulnerabilities. Feel free to get in touch with us!

Microsoft

Of the CVEs patched today, seven are classified as critical and 60 as important. A total of 10 of these bugs came through the ZDI programme. Five of these bugs are listed as publicly known, and one is listed as publicly exploited at the time of publication.

CVE-2021-43890- Windows AppX Installer This patch fixes a flaw in the AppX installer that affects Windows. Microsoft states that they have seen the flaw in malware in the Emotet / Trickbot / Bazaloader family. An attacker would need to create a malicious attachment to be used in phishing campaigns. The attacker would then need to trick the user into opening the specially crafted attachment.
CVE-2021-43890- Windows AppX Installer This patch fixes a flaw in the AppX installer that affects Windows. Microsoft states that they have seen the flaw in malware in the Emotet / Trickbot / Bazaloader family. An attacker would need to create a malicious attachment to be used in phishing campaigns. The attacker would then have to trick the user into opening the specially crafted attachment.

A list of all patches including corresponding downloads is provided Microsoft .

Adobe

For December, Adobe released 11 patches for 60 CVEs in Adobe Audition, Lightroom, Media Encoder, Premiere Pro, Prelude, Dimension, After Effects, Photoshop, Connect, Experience Manager and Premiere Rush.

Security updates available for Adobe Experience Manager | APSB21-103: The most serious of these updates affects Adobe Experience Manager. This patch fixes eight different bugs, including one that has been categorised as CVSS 9.8 and several Saved Cross-Site Scripting (XSS) issues.
Available security updates for Adobe Premiere Rush | APSB21-101: The patch for Premiere Pro only fixes five CVEs, but one of them is a Critical-Rated Out-of-Bounds (OOB) write that could allow arbitrary code execution. The specific bug exists when parsing 3GP files

SAP

Update to security note on Patch Day: security updates for Google Chrome browser control shipped with SAP Business Client product - SAP Business Client, version - 6.5 - is classified as critical.
CVE-2021-44231Code Injection Vulnerability in SAP ABAP Server & ABAP Platform (Translation Tools) Product - SAP ABAP Server & ABAP Platform (Translation Tools), Versions - 701, 740.750,751,752,753,754,755,756,804 - classified as Hot news.
[CVE-2021-42064]SQL Injection Vulnerability in SAP Commerce Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011 - Security Warning Level: High.

Next patchday on 11.01.22. Until then, stay safe and healthy and have a good New Year!

Anonymous