Patchday July 2021

In the past, some companies have already had to painfully experience what IT vulnerabilities can really do. A vulnerability is currently causing a stir. Attackers have managed to distribute ransomware on the systems of the district administration in the Anhalt-Bitterfeld district in Saxony-Anhalt via the PrintNightmare vulnerability, which has been known since the beginning of July. datensicherheit.de reported that this led to a complete failure of the administrative IT system. The district of Anhalt-Bitterfeld declared a disaster and is currently working in emergency mode.

This shows once again how important good patch management is!

Microsoft

In July 2021, Microsoft released patches for 117 CVEs for Microsoft Windows, Dynamics, Exchange Server, Office, Storage Spaces Controller, Bing, SharePoint Server, Inter Explorer, Visual Studio and OpenEnclave. 13 were categorised as critical, 103 as important and one as moderate. According to Microsoft, six of these vulnerabilities are considered publicly known at the time of publication and four are listed as actively under attack.

CVE-2021-34527- Windows Print Spooler Remote Code Execution Vulnerability. This vulnerability is also known as PrintNightmare. Microsoft has already released several updates for this vulnerability. Once successfully exploited, attackers could execute arbitrary code with SYSTEM privileges. They could then install programmes, view, change or delete data and create new accounts with full user rights. To fix this vulnerability, it is important to realise that it is not enough to simply install the update. To fully protect the systems, it must be ensured that a specific registry key is set to zero. Microsoft provides detailed instructions.
CVE-2021-34448 - Scripting Engine Memory Corruption Vulnerability. Attackers attempt to trick the user into clicking on a link in an email or instant messenger message to open a manipulated file. An attacker could then host a website.
CVE-2021-34458 - Windows Kernel Remote Code Execution Vulnerability. This vulnerability in the kernel could allow remote code execution and affects systems hosting virtual machines with Single Root Input/Output Virtualisation (SR-IOV) devices. As this vulnerability has been rated 9.9, you should test around it and patch if necessary.

Zero Day Initiative reports that there has been an increase in bugs compared to recent months. Of the bugs published in July, 17 were reported via the ZDI programme. A well-organised overview and some insider information can be found in their blog.

SAP

SAP published 12 security advisories and three updates to previously published security advisories in July. Two vulnerabilities were categorised as "Hot News" with a threat level of nine and ten and should be fixed immediately!

A security update for SAP Business Client, version - 6.5. This note was already published in August 2018 and concerns the Google Chromium browser control delivered with the SAP Business Client
The CVE-2021-27610 and affects SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804. Information about internal and external RFC users may not be in a consistent and distinguishable format, which in turn may lead to improper authentication. Attackers could exploit the vulnerability to gain access to the systems.
CVE-2021-33671 - Missing authorisation check in SAP NetWeaver Guided Procedures (Administration Workset), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, was classified as "High" with a CVSS of 7.6
CVE-2021-33670 - Denial of Service (DoS) in SAP NetWeaver AS for Java (Http Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 was also rated as "High" with a CVSS of 7.5

SAP provides information and updates and advises users to fix the vulnerability rated ten immediately.

Adobe

Adobe published patches for 29 CVEs for five products with critical and important security vulnerabilities in July. All vulnerabilities should be fixed as soon as possible, as attackers could execute arbitrary code in the context of the current user if exploited. None of these flaws are considered publicly known or active at the time of publication.

Next patchday: 10. Until then, stay safe and healthy!

Max Mustermann