Patchday October 2021

October is an exciting month every year. Not only can we look forward to Halloween, but also to the annual European Cyber Security Month (ECSM), organised by BSI (German Federal Office for Information Security) and ENISA (European Union Agency for Cybersecurity). The ECSM aims to raise awareness and educate citizens and organisations on how to act prudently and responsibly in cyberspace.

This year, we are focussing on endpoint security as part of the ECSM . Under the title Ying and Yang - Home Office and Endpoint Security in Harmony, we would like to take a closer look at this topic. One part of endpoint security is patch management, which is essential to ensure the security of a company's systems and all end devices. Regularly installing updates and closing potential security gaps minimises the opportunities for attackers to infiltrate systems.

The monthly patch day should therefore be a regular date in the calendar of all IT administrators! Let's take a look at the vulnerabilities released in October by Adobe, SAP and Microsoft.

Microsoft

71 CVEs were reported by Microsoft in October for Windows 10 and 11, Microsoft Edge (Chromium-based), Exchange Server, .NET Core and Visual Studio, Microsoft Office Services and Web Apps, SharePoint Server, Microsoft Dynamics, InTune, System Center Operations Manager and various Windows components. Of these, two are categorised as critical, 68 as important and one as minor. Of the patches released, three were categorised as publicly known and one was considered to be under active attack at the time of release.

CVE-2021-40449 - Win32k Elevation of Privilege Vulnerability. This vulnerability is considered actively attacked and the patch corrects a kernel flaw. This type of flaw is typically used in conjunction with code execution flaws to take over a system. Zero Day Initiative indicates that this flaw may have been used for a targeted malware attack and more information will follow in the coming days.
CVE-2021-26427 - Microsoft Exchange Server Remote Code Execution Vulnerability. This vulnerability has been reported by the NSA (National Security Agency) and is considered to be under active attack. A possible attack of this vulnerability is limited to a logically neighbouring topology at the protocol level and cannot be carried out via the Internet. Attackers attempt to make changes to the Exchange target server via a neighbouring network.

The following CVEs are publicly known:

CVE-2021-41338 - Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability. Attackers could exploit this vulnerability to access the target system locally via the keyboard or remotely via SSH. Another possibility would be to hope that users execute a malicious document. This could result in information disclosure, which would have immediate and severe consequences.
CVE-2021-40469 - Windows DNS Server Remote Code Execution Vulnerability. This vulnerability is considered "remotely exploitable" as it can be exploited across the entire Internet, e.g. at protocol level or through multiple network hops. An attacker can gain administrative rights in the event of a successful attack.
CVE-2021-41335 - Windows Kernel Elevation of Privilege Vulnerability. The same assessment applies here as for CVE-2021-41338.

Microsoft provides information on all vulnerabilities and their updates.

Adobe

Adobe published 10 vulnerabilities in Adobe Acrobat and Reader, Acrobat Reader for Android, Adobe Campaign Standard, Commerce, Ops-CLI and Adobe Connect in October. At the time of publication, none of the patches reported by Adobe were considered publicly known or under active attack.

APSB21-104: The security updates for Adobe Acrobat and Reader fix several critical and moderate vulnerabilities. If successfully exploited, attackers can execute arbitrary code in the context of the current user.
The vulnerability CVE-2021-40724 affects Acrobat Reader for Android and has been assigned a high risk rating. If successfully exploited, information related to the current user may be disclosed.

An overview of all security vulnerabilities is provided by Adobe.

SAP

In October, SAP published 13 security advisories and an update.

The security update for Googel Chromium was published back in April and rated as HotNews with a severity level of 10. Security updates for the browser control Google Chromium delivered with SAP Business Client Product - SAP Business Client, Version - 6.5

Two other newly published security advisories have been classified as HotNews:

Potential XML External Entity Injection Vulnerability in SAP Environmental Compliance Related CVEs - CVE-2020-10683, CVE-2021-23926 Product - SAP Environmental Compliance, Version - 3.0. XXE attacks can enable port scanning and lead to remote code execution if successfully exploited.
[CVE-2021-38178] Improper Authorisation in SAP NetWeaver AS ABAP and ABAP Platform Product - SAP NetWeaver AS ABAP and ABAP Platform, Versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756. Exploitation of this vulnerability can jeopardise the confidentiality, integrity and availability of the system and data.

Information about all patches is provided by SAP .

Source: Security Notes vs Priority Distribution (May - October 2021), SAP