Patchday April

‍On the second Tuesday of every month, Microsoft, Adobe and SAP release the latest security updates. All software should be updated to the latest version and security updates installed. This is because attackers are on the ball and often exploit newly disclosed vulnerabilities.

Microsoft

The BSI again reported acute vulnerabilities in Microsoft Exchange with IT threat level 2/yellow (IT threat level with increased observation of anomalies with temporary impairment of regular operations). A further four vulnerabilities categorised as critical offer attackers the opportunity to execute code remotely.

The two vulnerabilities CVE-2021-28480 and -28481, were rated with a score of 9.8. Due to this high rating from Microsoft, you can assume that they will be exploited at some point and should update your systems immediately.

Own presentation

In total, Microsoft published 114 CVEs that affect Microsoft Exchange Server, Windows Edge, Azure and Azure DevOps Server, Office, SharePoint Server, Hyper-V, Team Foundation Server and Visual Studio. According to the Zero Day Initiative, this is the largest number of CVEs published by Microsoft so far in 2021. 19 are categorised as critical, 88 as important and one as moderate.

The only vulnerability listed as active is CVE-2021-28310- Win32k Elevation of Privilege Vulnerability. It could allow attackers to elevate privileges on remote systems. Presumably using malware and in combination with, for example, a browser bug or a PDF exploit, with subsequent takeover of the system.

All CVEs represent an attack surface for attackers and should be fixed as quickly as possible. Microsoft provides all security updates in the Security Update Guide.

‍

Adobe

Adobe released security updates for Photoshop, Digital Editions, Bridge and RoboHelp this month.

APSB21-28 affects Photoshop and is classified as critical. Attackers can execute arbitrary code in the context of the current user.

APSB21-26 is also classified as critical and affects Digital Editions. If it is not fixed, arbitrary files could be written to the system.

APSB21-23 affects several critical and important vulnerabilities for Bridge. It could lead to the execution of arbitrary code in the context of the current user.

APSB21-20 is an update for RoboHelp and prevents privilege escalation by attackers. It is classified as important.

The latest information on product updates from Adobe can be found at helpx.adobe.com.

‍

SAP

SAP is also seeing an increase in security notes:

Security Notes vs Priority Distribution (source: SAP)

‍

SAP publishes 14 current and five updates to previously published security notes in April.

Three advisories reported as Hot News relate to the products SAP Business Client, SAP Commerce and SAP NetWeaver AS JAVA.

Five security advisories classified as High concern these products:

NetWeaver Master Data Management
Solution Manager
Missing Authorisation check in SAP NetWeaver AS ABAP and SAP S4 HANA
NetWeaver AS for Java

The detailed list of all security advisories published by SAP in April can be found in the Community Wiki.

Mark the next Patchday in red in your calendar now: 11.Until then, stay safe and healthy!

Max Mustermann