Patchday February

‍What exactly is a vulnerability?

According to the dictionary, a vulnerability is a point at which something is susceptible to disruption.

What vulnerabilities are there in IT, especially in corporate networks?

Human vulnerability
System vulnerability

People as the weakest link in the chain?

Here you have to say quite clearly: unfortunately yes! Spam emails, weak passwords and fake attachments still represent a high risk potential. For the attackers, these types of attack mean less effort and, above all, are significantly more profitable than the development of an expensive, time-consuming technology-based exploit, explains Kevin Epstein, Vice President of Threat Operations at Proofpoint (source: it-daily.net).

Strengthen your employees and reduce the risk potential with regular security awareness trainings!

‍

Leave no door unsecured!

Why then spend time and money on vulnerability management of the system?

Because a versatile approach on the part of the attacker increases the chance of finding an open door somewhere. And this one open door is enough for the attacker to secretly set up shop in the system. And since attackers do not keep to normal working hours, regular scanning for and elimination of vulnerabilities is necessary to minimise the security risk.

A good place to start is Microsoft's monthly patch day, which should be a fixed date in every IT administrator's calendar!

Microsoft patches

56 CVEs were published by Microsoft in February 2021. 11 of these are classified as critical, 43 as important and two as moderately serious. One bug that is actively exploited is known and there are 6 bugs listed as publicly known.

According to Trend Micro's Zero Day Initiative, this is only half as many patches as were reported in February 2020. However, there are currently an unusually high number of publicly known CVEs.

The CVE-2021-1732 is a Windows Win32k elevation-of-privilege vulnerability and could allow an attacker to execute code of their choice with elevated privileges. Combined with another flaw, e.g. via an Adobe Reader exploit, opening a manipulated PDF file could lead to code execution through the Reader bug and subsequent escalation.

The only critical and publicly known flaw is CVE-2021-26701, a .NET Core and Visual Studio remote code execution vulnerability. Unauthenticated attackers could execute arbitrary code on an affected system. Action must be taken quickly in any case.

The other CVEs classified as important and publicly known are

CVE-2021-1721. NET Core and Visual Studio Denial of Service Vulnerability
CVE-2021-1733 Sysinternals PsExec Elevation of Privilege Vulnerability
CVE-2021-24098 Windows Console Driver Denial of Service Vulnerability
CVE-2021-24106 Windows DirectX Information Disclosure Vulnerability
CVE-2021-1727 Windows Installer Elevation of Privilege Vulnerability

Microsoft provides the update downloads in its Security Update Guide!

Adobe patches

Adobe released patches for this month

Dreamweaver
Illustrator
Animate
Photoshop
Magento
Acrobat and Reader

Of the total of 23 CVEs, 17 were categorised as critical. The CVE-2021-21017 (Heap-based Buffer Overflow) should be prioritised for patching. It is listed as among "limited" active attacks on Reader for Windows.

Of the 18 reported CVEs affecting Magento, seven were categorised as critical, and five for Photoshop.

Adobe provides all important information on the security vulnerabilities.

SAP Patches

SAP publishes seven security advisories and six updates to previously published security advisories.

CVEs with the priority "Hot News" affect the following products:

SAP Business Client, Version - 6.5
SAP Commerce, Versions - 1808,1811,1905,2005,2011
SAP Business Warehouse, Versions - 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 782. Prompt patching is recommended here, as there is a risk of complete system compromise.

Products for which CVEs classified as "High" have been published:

SAP NetWeaver AS ABAP (SAP Landscape Transformation - DMIS), Versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), Versions - 101, 102, 103, 104, 105
SAP NetWeaver AS ABAP, Versions - 740, 750, 751, 752, 753, 754, 755

Also SAP provides all information and updates.

‍

Stay safe and healthy, until the next Patchday on 9 March!