Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.
Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.
Fixes for two Chrome zero-days under attack
Google has patched its Chrome web browser on Windows, Mac, and Linux with fixes for high-risk two vulnerabilities that are being actively exploited.
The two flaws are CVE-2021-21220, which is based on insufficient validation of untrusted input in the V8 JavaScript rendering engine, and CVE-2021-21206, which is a use-after-free bug in the Blink browser engine. Hackers are exploiting these two flaws to execute code in a victim’s web browser, but depending on the privileges tied with the browser, an attacker could also view, change, or delete data.
The former vulnerability was demonstrated by Dataflow Security researchers Bruno Keith and Niklas Baumstark at the Pwn2Own 2021 hacking contest, while an anonymous researcher has been credited with reporting the latter flaw to Google.
NSA find new Exchange Server vulnerabilities
Microsoft has released patches for four newly discovered vulnerabilities in its Exchange Server systems only a few weeks after hackers were revealed to be exploiting Exchange Server bugs to target mostly on-premise data centres.
The flaws, which aren’t related to the initial attacks, apply to versions 2013, 2016, and 2019 of the operating system, and were discovered by the US National Security Agency (NSA). They include CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, and CVE-2021-28483. All four are remote code execution flaws, while the first two are pre-authentication in nature, meaning an attacker won’t need to authenticate to a vulnerable Exchange server to exploit.
The most severe is rated 9.8/10 on the CVSS threat severity scale, while another critically-rated flaw is rated 9/10, and the least severe is rated 8.8/10.
Desktop Window Manager exploit among Patch Tuesday fixes
Alongside the four Exchange Server vulnerabilities, Microsoft this week released more than a hundred fixes across its product portfolio, including one for an actively exploited flaw in Desktop Window Manager.
Tracked as CVE-2021-28310, this escalation of privilege flaw is likely being used in a chain alongside other exploits to seize control of victims’ devices. The flaw is an out-of-bounds write vulnerability in dwmcore.dll, which is part of the Desktop Window Manager executable, according to researchers with Kaspersky’s SecureList. It's allowed attackers to execute arbitrary code, create accounts with full privileges, access or delete data and install software.
Microsoft patched 19 critical flaws and 88 tagged as being important as part of its latest wave of Patch Tuesday updates, including the four previously mentioned Exchange Server vulnerabilities.
Millions of IoT devices at risk
Nine vulnerabilities in four TCP/IP communication protocols commonly used by millions of Internet of Things (IoT) devices may lead to denial of service (DoS) or remote code execution attacks.
More than 100 million consumer and industrial IoT devices are potentially affected by the ‘Name:Wreck’ flaws, according to Forescout and JSOF researchers. The nine vulnerabilities affect the FreeBSD, Nucleus NET, IPnet, and NetX TCP/IP stacks, relating to Domain Name System (DNS) implementations, which means attackers can exploit the flaws to knock target devices offline or take complete control over them.
The researchers have recommended that developers of TCP/IP stacks review their code for any bugs and immediately fix them. FreeBSD, Nucleus NET and NetX have recently been patched, so customers should update their IoT devices immediately in order to fully protect themselves against exploitation.
