Patchday June 2021

‍

And another four weeks have passed. Every second Tuesday of the month, Microsoft, Adobe and SAP release the latest security updates. The following points can support your patch management.

Keep track
Use automatic updates
Note the instructions for updates
List the programmes, for which you need to manually install updates
Check regularly with the manufacturers for updates
React as quickly as possible to vulnerabilities
Get updates only from reputable websites
Watch out for product discontinuation announcements

A detailed guide to patch management is provided by the BSI is available.

Microsoft

In June, Microsoft released patches for 50 CVEs, five of which were classified as critical and 45 as important. Six are listed as currently active:

CVE-2021-33742 Windows MSHTML Platform Remote Code Execution Vulnerability - By invoking crafted web content, attackers could execute code on the target system. As this vulnerability affects all supported versions of Windows, it is recommended to test immediately and patch if necessary.
CVE-2021-33739 Microsoft DWM Core Library Elevation of Privilege Vulnerability -An attacker could try to gain access to the systems, e.g. through a phishing attack, to cause escalation of privileges.
CVE-2021-31199 and CVE-2021-31201 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability - This is related to an Adobe Reader flaw that was considered active in May (CVE-2021-28550). The security updates from June should definitely be installed in order to be protected against the three vulnerabilities.
CVE-2021-31955 Windows Kernel Information Disclosure Vulnerability - By exploiting this vulnerability, attackers could read the contents of kernel memory from a process in user mode.
CVE-2021-31956 Windows NTFS Elevation of Privilege Vulnerability - According to the Zero Day Initiative, this is an information disclosure flaw. There is a possibility that this bug is related to CVE-2021-31955 to obtain the address needed for privilege escalation by using a memory leak.

Of course, the six CVEs listed as active have the highest priority in testing and applying the patches, but the remaining 44 must be given no less attention. The required security updates can be found in the Microsoft Security Guide.

‍

Adobe

Adobe published 39 CVEs in June. Several security updates affecting Acrobat and Reader are categorised as critical or important. Adobe warns that CVE-2021-28550 has been exploited to a limited extent in attacks against Adobe Reader users on Windows and that this vulnerability remains under observation by attackers.

Additional patches have been reported for the following programs:

Adobe Connect, Photoshop Elements and Premiere Elements: successful exploitation could lead to privilege escalation in the context of the victim's browser.
Photoshop, Creative Cloud Desktop Application, RoboHelp Server, After Effects and Animate: Successful exploitation may lead to the execution of arbitrary code in the context of the current user.
Experience Manager: Successful exploitation may lead to the execution of arbitrary JavaScript in the browser

This month, none of the vulnerabilities disclosed by Adobe were considered publicly known or under active attack at the time of publication. A detailed overview of the security updates and the corresponding updates is provided by the Adobe Product Security Incident Response Team (PSIRT).

‍

SAP

Source: Security Notes vs Priority Distribution (January - June 2021)

‍

After the drop in security notes in May, there was an increase in June. SAP published a total of 19 security notes, two of which were categorised as "Hot News" and four as "High".

‍

"Hot News"

CVE-2021-27602SAP Commerce, Versions
CVE-2021-27610SAP NetWeaver AS ABAP and ABAP Platform

"High"

CVE-2021-27635SAP NetWeaver AS for JAVA
Multiple CVEs - CVE-2021-27606, CVE-2021-27629, CVE-2021-27630, CVE-2021-27631, CVE-2021-27632SAP NetWeaver AS for ABAP (RFC Gateway)
Multiple CVEs - CVE-2021-27597, CVE-2021-27633, CVE-2021-27634SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server
Multiple CVEs - CVE-2021-27607, CVE-2021-27628SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher)

Further information on the CVEs classified as "Medium" and the links to the corresponding patches is provided SAP.