
close
close
It’s a quiet start for Microsoft in 2021 as it issues patches for only 80 vulnerabilities, which is considerably lower than most months. Among them are a fix for a zero-day bug in Microsoft’s Defender software and a fix for a flaw publicly disclosed at the tail of end last year by Trend Micro ZDI.
This month Microsoft fixed a critical zero-day flaw (CVE-2021-1647) in its Defender product, the built-in malware protection software in Windows. The vulnerability is being actively exploited and while Microsoft hasn’t published details, it’s believed that the flaw can be easily exploited by hackers.
advertisment
KerbsOnSecurity quotes Kevin Breen, director of research at Immersive Labs, as saying “It could be as simple as sending a file. The user doesn’t need to interact with anything, as Defender will access it as soon as it is placed on the system.” The patches for Microsoft Defender are automatically installed by Windows Update unless explicitly blocked by system administrators.
A critical remote code execution (RCE) bug (CVE-2020-1660) in the Remote Procedure Call (RPC) runtime gets patched. RPC is often used to manage communications between Windows devices and it has in the past been a popular mechanism for viruses known as worms. Worms can spread easily between computers without any user interaction. CVE-2020-1660 is one of 5 RPC bugs patched this month.
An elevation of privilege (EoP) bug in the splwow64 service, made public last month by Trend Micro’s Zero-Day Initiative (ZDI) project, has also been patched. Microsoft says that while details about CVE-2021-1648 were publicly available, it wasn’t exploited in the wild.
Microsoft released a patch for an EoP bug in Microsoft SQL Server 2012, 2014, 2016, 2017, and 2019. It is rated important and Microsoft says that an authenticated attacker could send data over a network to an affected SQL Server when configured to run an Extended Event session.
advertisment
There are 9 patches for SharePoint Server. All are rated important and include EoP, spoofing, and RCE flaws. There are no patches for Exchange Server this month.
Microsoft 365 Apps for Enterprise (Click-to-Run) get patches for five important RCE vulnerabilities. Microsoft Office 2010 through 2019 also gets a series of patches for RCE bugs, all rated important.
Flash Player is now officially dead but that doesn’t mean there won’t be important patches from Adobe. This month sees Adobe patch flaws in Photoshop, Illustrator, Animate, Campaign Classic, InCopy, Captivate, and Bridge. You can find more information about the patches on Adobe’s website here.
And that’s it for another month. Happy patching!
advertisment
More from Russell Smith
advertisment
Petri Newsletters
Whether it’s Security or Cloud Computing, we have the know-how for you. Sign up for our newsletters here.
advertisment
More in Security
CISA Warns Federal Agencies to Mitigate Critical VMware Vulnerabilities by May 23
May 20, 2022 | Rabia Noureen
CISA Warns Windows Admins Against Applying May Patch Tuesday Updates on Domain Controllers
May 17, 2022 | Rabia Noureen
Microsoft's New Security Experts Service Protects Businesses Against Ransomware Attacks
May 9, 2022 | Rabia Noureen
Microsoft, Google, and Apple to Expand Passwordless Login Across All Major Platforms
May 5, 2022 | Rabia Noureen
Most popular on petri
Log in to save content to your profile.
Article saved!
Access saved content from your profile page. View Saved
Join The Conversation
Create a free account today to participate in forum conversations, comment on posts and more.
Copyright ©2019 BWW Media Group