VERT Threat Alert: March 2021 Patch Tuesday Analysis

Image

Today’s VERT Alert addresses Microsoft’s March 2021 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-933 on Wednesday, March 10th.

In-The-Wild & Disclosed CVEs

CVE-2021-26855
CVE-2021-26857
CVE-2021-26858
CVE-2021-27065

These CVEs are part of the bundle of Exchange vulnerabilities that were patched last week, more specifically, these are the four CVEs that were experiencing active exploitation. Tripwire VERT released coverage for these in ASPL-932. While these attacks started out with the state-sponsored threat actor known as Hafnium, Microsoft has reported multiple threat actors are now abusing these vulnerabilities. Krebs on Security has published a basic timeline of the attack and ZDNet has been providing coverage as well. The Cybersecurity and Infrastructure Security Agency has issued an emergency directive related to this, as has the Canadian Centre for Cyber Security. It is critical that these systems are patched as soon as possible, especially since estimates indicate that over 30,000 servers have been compromised already.

Microsoft has rated this as Exploit Detected on the latest software release on the Exploitability Index.

CVE-2021-26411

A vulnerability in Microsoft Internet Explorer and the EdgeHTML-based Microsoft Edge is currently experiencing active exploitation. To successfully exploit this vulnerability, an attacker would need to direct the victim to a website, which would typically be accomplished via a phishing attack or some other form of social engineering.

Microsoft has rated this as Exploit Detected on the latest software release on the Exploitability Index.

CVE-2021-27077

This CVE describes a disclosed but not yet exploited vulnerability in Win32k that could allow for privilege escalation. This is a local vulnerability, meaning that an attacker must already have access to the system in order to exploit this issue.

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis.

Other Information

There were no advisories included in the March security guidance.