Microsoft Patch Tuesday for May 2021 — Snort rules and prominent vulnerabilities

Summary: Microsoft's May 2021 security update disclosed 55 vulnerabilities, the fewest in any month since January 2020, with three rated critical, two moderate, and the rest important. All three critical flaws are considered more likely to be exploited, including CVE-2021-31166, a wormable remote code execution vulnerability in the HTTP protocol stack with a CVSS score of 9.8 that Microsoft says is of low complexity to exploit.
What you should know: A wormable, unauthenticated remote code execution flaw in the HTTP stack at 9.8 severity means an attacker who sends one crafted packet to an unpatched server can run code on it, and Microsoft itself recommends prioritizing patching of affected servers.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-2641 CVE-2021-31166 CVE-2021-31170 CVE-2021-31194
Related: CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 06, 2022
Latest Microsoft Windows Updates Patch Dozens of Security Flaws Cyber Risks ·
Threat Source Newsletter (May 13, 2021) Cyber Risks ·