Patchday November 2021

Few vulnerabilities were released by Microsoft, SAP and Adobe this November, if you compare the November figures from the last few years. Let's take a look at the most important ones!

Microsoft

Microsoft released patches for 55 CVEs for the products in November 2021: Microsoft Windows and Windows Components, Azure, Azure RTOS, Azure Sphere, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Microsoft Office and Office Components, Windows Hyper-V, Windows Defender, and Visual Studio. Of the CVEs assessed, six were categorised as critical and 49 as important.

Two flaws are listed as actively exploited:

CVE-2021-42321 - Microsoft Exchange Server Remote Code Execution Vulnerability: This type of vulnerability is described as "remotely exploitable". It could be exploited at the protocol level via network hops and should be fixed as soon as possible. Microsoft has published a blog to help Exchange administrators deploy the patches.
CVE-2021-42292 - Microsoft Excel Security Feature Bypass Vulnerability: This patch fixes a flaw that can allow code execution when opening a specially crafted file with an affected version of Excel. The attacker's path leads via read, write and execution functions. The Zero Day Initiative points out that users of Office for Mac in particular should not open any unknown attachments, as there is currently no patch available for Mac users.

A list of all patches including the corresponding downloads is provided by Microsoft.

Adobe

In November, Adobe released three patches that correct four CVEs.

Security update available for Adobe Creative Cloud Desktop Application | APSB21-111: This update fixes a security vulnerability classified as important, which can lead to a denial of service of the application in the context of the current user.
Security Update Available for Adobe InCopy | APSB21-110: Critical and important vulnerabilities are fixed with this update. Successful exploitation could lead to the execution of arbitrary code and the denial of services by applications.
Security hotfix available for RoboHelp Server | APSB21-87: This update fixes a security vulnerability classified as critical. Successful exploitation could lead to the execution of arbitrary code in the context of the current user.

None of the patches released today were considered publicly known or actively under attack at the time of release.

SAP

SAP released 5 security advisories and 2 updates to previously released advisories in November.

[CVE-2021-40501] Missing Authorisation check in ABAP Platform Kernel Product - SAP ABAP Platform Kernel, Versions - 7.77, 7.81, 7.85, 7.86: There is currently no further information on the security advisory classified as Hot News.
[CVE-2021-40502] Missing Authorisation check in SAP Commerce Product - SAP Commerce, Versions - 2105.3, 2011.13, 2005.18, 1905.34: No further information is yet available on this security note, which is classified as High.
Update to Security Note released on October 2020 Patch Day: [CVE-2020-6369] Hard-coded Credentials in CA Introscope Enterprise Manager (Affected products: SAP Solution Manager and SAP Focused. Product- CA Introscope Enterprise Manager (Affected products: SAP Solution Manager and SAP Focused Run), Versions - 9.7, 10.1, 10.5, 10.7: This security advisory has been rated High. Unauthenticated attackers could bypass authentication if the default passwords for Admin and Guest have not been changed by the administrator.

It seems to be getting a little quieter at SAP with security advisories towards the end of the year:

Source: Security Notes vs Priority Distribution (June - November 2021), SAP

‍

Further information on all security notes is provided SAP.