VERT Threat Alert: April 2021 Patch Tuesday Analysis

Image

Today’s VERT Alert addresses Microsoft’s April 2021 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-939 on Wednesday, April 14th.

In-The-Wild & Disclosed CVEs

CVE-2021-28310

Borin Larin of Kaspersky Lab discovered this vulnerability being actively used for exploitation and suspects that it is tied to the BITTER APT group. Larin and co-authors have released a detailed technical write-up on this vulnerability that impacts the Desktop Window Manager.

Microsoft has rated this as Exploit Detected on the latest software release on the Exploitability Index.

CVE-2021-28312

This publicly disclosed denial of service impacts the Windows NTFS file system. Newer versions of Windows 10 as well as Windows Server 2019 and Server version 20H2 are impacted. This appears to be the same vulnerability detailed by BleepingComputer back in January. While an unpatched system will output, “The file or directory is corrupted and unreadable.” when executing the proof of concept, a patched system will output, “The directory name is invalid.”

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE-2021-28437

A publicly disclosed information disclosure in the Windows Installer could allow attackers to read from the file system. Based on the Microsoft security guidance, all versions of Windows from Windows 7 to Windows 10 and their associated server platforms are vulnerable.

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE-2021-28458

The final publicly disclosed vuln this month is found in @azure/ms-rest-nodeauth, a node-js library for Azure authentication. The fix for this vulnerability was committed on March 23, 2021 and can be reviewed on github.

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE-2021-27091

This publicly disclosed privilege elevation vulnerability in the RPC Endpoint Mapper Service only affects older operating systems with patches available for Windows 7, Windows Server 2008 R2, and Windows Server 2012. 

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis.

Other Information

There were no advisories included in the April security guidance. There are, however, other vulnerabilities of note.

Apply Microsoft April 2021 Security Update to Mitigate Newly Discovered Microsoft Exchange Vulnerabilities. [US-CERT]

The National Cyber Awareness System has a new update regarding a set of vulnerabilities discovered by the NSA in Microsoft exchange. They recommend applying these updates immediately and have issued Supplemental Directive Version 2 to the previously released ED 21-02. This includes:

• CVE-2021-28480
• CVE-2021-28481
• CVE-2021-28482
• CVE-2021-28483

Kerberos KDC Security Feature Bypass Vulnerability [CVE-2020-17049]

Microsoft has released version 5 of this security guidance as the default settings have now changed. It is now assumed that all domain controllers have the December update installed. Additionally, the PerformTicketSignature registry key can no longer be set to 0, which previously disabled Kerberos Service Ticket Signatures, leaving domains unprotected. Now, if you set PerformTicketSignature to 0, it will act the same as if it were set to 1. You can find more details in KB4598347.