Patchday August 2021

‍Summer slump? Not for the hackers! The patchday for August 2021 is here. Stay up to date on security vulnerabilities and act early.

Microsoft

Microsoft released patches for 44 CVEs in Microsoft Windows in August, as well as Windows components, Dynamics, Office, .NET Core and Visual Studio, SharePoint, Windows Defender, Windows Update and Update Assistant and Azure. Seven were categorised as critical and 37 as important. According to the Zero Day Initiative, this was Microsoft's smallest release in 2021. The reason could be the events surrounding PrintNightmare and PetitPotam, for which resources had to be diverted.

Microsoft released a new update for the security vulnerability known as PrintNightmare. However, security experts believe that the systems remain vulnerable, albeit to a lesser extent. The update for the CVE-2021-34481, Windows Print Spooler Remote Code Execution Vulnerability, only affects the installation behaviour for new point and print drivers. In future, drivers can only be installed with administration rights. Detailed information on this vulnerability is available from Microsoft's support.

The mentioned PetitPotam vulnerability is the CVE-2021-36942 - Windows LSA Spoofing Vulnerability: This update is intended to improve protection against NTLM relay attacks. This is a problem that has been known since 2009 and is likely to continue in the future.

The CVE-2021-36936 - Windows Print Spooler Remote Code Execution Vulnerability, it is not yet clear whether it is a variant of PrintNightmare or whether it is a separate vulnerability. According to Microsoft, this vulnerability is not considered harmful, but should still be considered.

Of the 44 CVEs, two are considered publicly known and one is listed as actively under attack at the time of publication.

CVE-2021-36948 - Windows Update Medic Service Elevation of Privilege Vulnerability: This is the vulnerability under active attack. If successfully exploited, this vulnerability allows attackers to gain local privilege elevation via the Windows Update Service. It is not known how widespread the attacks actually are, but it is suspected that they are targeted.

For more information on all CVEs and the corresponding downloads, Microsoft provides more detailed information on all CVEs and the corresponding downloads.

SAP

SAP published 14 security advisories in August, as well as an update to one that had already been published. Of the 14, three were classified as Critical, five as High and seven as Medium.

Compared to June 21, August is somewhat quieter, similar to July.

Source: Security Notes vs Priority Distribution (March - August 2021), SAP

‍

The following CVEs are considered critical:

Further information on the entire security vulnerabilities is provided by SAP in the Community Wiki.

Adobe

Adobe released two patches in August that fix 29CVEs in the Adobe Connect and Magento programmes. The security update for Connect (APSB21-66) was categorised as important. It fixes a security feature bypass and two cross-site scripting bugs.

The updates for Magento (APSB21-64) affect Magento Commerce and Magento Open Source Edition. The vulnerabilities have been classified as critical and important.

Successful exploitation of these vulnerabilities can lead to the execution of arbitrary code, which is why they should be fixed promptly. None of the vulnerabilities published by Adobe were publicly known or under active attack at the time of publication.

Adobe provides further information and downloads.

Next patch day is 14. Until then, stay safe and healthy!

Max Mustermann