Patchday September 2021

A rainy autumn day... Time to patch security vulnerabilities. Patchday for September 2021 is here. Stay up to date on security vulnerabilities and act early.

Microsoft

Microsoft released patches for 66 CVEs in Microsoft Windows and Windows components, Microsoft Edge (Chromium, iOS and Android), Azure, Office and Office components, SharePoint Server, Microsoft Windows DNS and the Windows subsystem for Linux in September. If you add the 20 CVEs that were already published for Microsoft Edge at the beginning of the month, the total number of CVEs is 86. Of the 66 newly reported, three were categorised as critical, 62 as important and one as moderate. According to the Zero Day Initiative, the volume in September is slightly higher compared to the average for previous months in 2021.

CVE-2021-40444 - Microsoft MSHTML Remote Code Execution Vulnerability: This patch fixes a flaw that is listed as an active attack and is exploited via Office documents. A specially crafted ActiveX control embedded in an Office document is sent via email. The code is executed at the level of the logged-in user when the document is opened. It is apparently not yet known whether the remedial measures listed by Microsoft - deactivating ActiveX - are actually sufficiently effective. It is advised to install the patch as soon as possible and to only open Word documents as email attachments from known recipients.

For more information on all CVEs and the corresponding downloads, please visit Microsoft provides more detailed information on all CVEs and the corresponding downloads.

SAP

SAP published 17 security advisories in September, as well as two updates to previously published ones. Of the 17 security advisories published, seven were rated as HotNews, each with a high score:

‍Update to Security Note released on April 2018 Patch Day: Security updates for the browser control Google Chromium delivered with SAP Business Client, Product - SAP Business Client, Version - 6.5, HotNews, CVSS 10
[CVE-2021-37535] Missing Authorisation check in SAP NetWeaver Application Server for Java (JMS Connector Service), Product - SAP NetWeaver Application Server Java (JMS Connector Service) , Versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, HotNews, CVSS 10
Update to Security Note released on August 2021 Patch Day: [CVE-2021-33698] Unrestricted File Upload vulnerability in SAP Business One, Product - SAP Business One, Versions - 10.0, HotNews, CVSS 9.9
[CVE-2021-38176] SQL Injection vulnerability in SAP NZDT Mapping Table Framework, Product - SAP S/4HANA, Versions - 1511, 1610, 1709, 1809, 1909, 2020, 2021, Product - SAP LT Replication Server, Versions - 2.0, 3.0 Product - SAP LTRS for S/4HANA, Version - 1.0, Product - SAP Test Data Migration Server, Version - 4.0, Product - SAP Landscape Transformation, Version - 2.0, HotNews, CVSS 9.9
[CVE-2021-38163] Unrestricted File Upload vulnerability in SAP NetWeaver (Visual Composer 7.0 RT), Product - SAP NetWeaver (Visual Composer 7.0 RT) , Versions - 7.30, 7.31, 7.40, 7.50, HotNews, CVSS 9.9
[CVE-2021-37531] Code Injection vulnerability in SAP NetWeaver Knowledge Management (XMLForms), Product - SAP NetWeaver Knowledge Management XML Forms , Versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, HotNews, CVSS 9.9
[CVE-2021-33672] Multiple vulnerabilities in SAP Contact Center, Additional CVEs - CVE-2021-33673, CVE-2021-33674, CVE-2021-33675, Product - SAP Contact Center, Version - 700, HotNews, CVSS 9.6

The number of vulnerabilities rises again slightly towards autumn:

Source: Security Notes vs Priority Distribution (April- September 2021), SAP

All security vulnerabilities and further information is provided SAP in the Community Wiki.‍

Adobe

Adobe released 15 patches in September that fix 59 CVEs in Adobe Acrobat Reader, XMP Toolkit SDK, Photoshop, Experience Manager, Genuine Service, Digital Editions, Premiere Elements, Photoshop Elements, Creative Cloud Desktop, ColdFusion, Framemaker, InDesign, SVG Native Viewer, InCopy and Premiere Pro.

For Adobe Acrobat and Reader (APSB21-55), 26 vulnerabilities have been fixed, of which 13 have been classified as critical, nine as important and four as moderately severe. Successful exploitation of these vulnerabilities could lead to the execution of arbitrary code in the context of the current user.

Adobe provides further information and downloads. At the time of publication, no vulnerability is publicly known or under active attack.

Next Patchday is on 12. Until then, stay safe and healthy!

Anonymous