Patchday May

And every month the groundhog greets us. Another four weeks have passed: Every second Tuesday of the month, Microsoft, Adobe and SAP release the latest security updates. All software should be updated to the latest version and security updates installed. This is because attackers are on the ball and often exploit newly publicised vulnerabilities. The updates have been available since yesterday evening.

Microsoft

Very important note: Windows 10, version 1909 will be released on 11. May 2021 for devices with the Home, Pro, Pro for Workstation, Nano Container and Server SAC editions. After 11 May 2021, these devices will no longer receive monthly security and quality updates that provide protection against the latest security threats. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

According to ZeroDayInitiative, Microsoft released patches in May for 55 CVEs in Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, open source software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. A total of 13 of these bugs were found via the ZDI programme. Of these 55 bugs, four are categorised as critical, 50 as important and one as moderate. According to Microsoft, three of these bugs are publicly known, but none are listed as actively exploited at the time of publication.

We provide some insights into the CVEs with the highest CVSS scores:

CVE-2021-31166 - HTTP Protocol Stack Vulnerability for Remote Code Execution

This patch fixes a flaw that could allow an unauthenticated attacker to remotely execute code as a kernel. An attacker would only need to send a specially crafted packet to an affected server. Please note: Windows 10 can also be configured as a web server and is therefore also affected. It is therefore better to put this at the top of your testing and implementation list.

CVE-2021-28476 - Hyper-V Remote Code Execution Vulnerability

With a CVSS score of 9.9, this flaw achieves the highest severity rating for this month's release. However, Microsoft points out that an attacker is more likely to abuse this vulnerability for a denial of service in the form of a bug check than for code execution. For this reason, one could argue that the attack complexity would be high, which changes the CVSS rating to 8.5. This is still a high severity, but not critical. Still, the bug check alone is worth making sure your Hyper-V systems get this update.

CVE-2021-27068 - Remote Code Execution Vulnerability in Visual Studio

This patch fixes an unusual flaw in Visual Studio 2019 that could allow code execution. It is unusual because it does not require user interaction, so it is unclear how an attacker would exploit this vulnerability. It appears that the attacker must be authenticated at some level, but the attack complexity is reported to be low. If you are a developer using Visual Studio, make sure you apply this update.

CVE-2020-24587 - Windows wireless network information disclosure vulnerability

Normally we don't point out information disclosure flaws, but this one has the potential to be quite damaging. This patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system. It's not clear what the range of such an attack would be, but you should assume that some proximity is required. You'll also notice that this CVE dates back to 2020, which could indicate that Microsoft has been working on this solution for some time.

All CVEs present an attack surface for attackers and should be fixed as soon as possible. Microsoft provides all security updates in the Security Update Guide.

Adobe

In May, Adobe released 12 patches that fix 44 CVEs in Experience Manager, InDesign, Illustrator, InCopy, Adobe Genuine Service, Acrobat and Reader, Magento, Creative Cloud Desktop, Media Encoder, After Effects, Medium and Animate.

The update for Acrobat and Reader should be the highest priority. One of the 14 CVEs fixed by this patch is listed as currently in use in the wild. The bug (CVE-2021-28550) is one of three Use-After-Free (UAF) bugs fixed by this patch. This and other vulnerabilities could lead to code execution if someone opens a specially crafted PDF file with an affected version of Acrobat or Reader. The update for InDesign also stands out. These flaws result from the lack of proper validation of user-supplied data, which can lead to writing beyond the end of an assigned structure. An attacker can exploit this vulnerability to execute code in the context of the current process.

Except for the one Reader bug, none of the other vulnerabilities Adobe patched this month are listed as publicly known or actively under attack at the time of publication.‍

SAP

For the month of May, we can see a drop in SAP s security notes. This does not mean that they should be ignored:

Source: Security Notes vs Priority Distribution (December 2020 - May 2021)**

‍

There is an official warning about the new Security Notes from BSI. This includes the following CVEs:

Please pay particular attention to CVEs 21466 and 27602, both of which were rated with a CVSS of 9.9.

‍

Mark the next patch day in red in your calendar now: 8 June 2021.

Until then, stay safe and healthy!