Microsoft Patch Tuesday, November 2021 Edition
Summary: Microsoft released updates on November 9, 2021 addressing at least 55 security bugs in Windows and other software, including two vulnerabilities already used in active attacks and four disclosed publicly before the patches. The exploited flaws are CVE-2021-42292, an Excel security feature bypass affecting versions 2013-2021, and CVE-2021-42321, an Exchange Server zero-day that requires the attacker to already be authenticated to the target system.
Bottom line: The RDP password-disclosure flaws CVE-2021-38631 and CVE-2021-41371 affect Windows 7 through 11 and Windows Server 2008-2019, and Recorded Future's Allan Liska noted that ransomware initial access brokers have a strong interest in RDP, making exploitation likely at some point.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-38631CVE-2021-38666CVE-2021-41371CVE-2021-42292CVE-2021-42321
- Related
- CVE-2021-42292: Microsoft Excel Security Feature Bypass Known Exploited Vulnerabilities · Nov 17, 2021CVE-2021-42321: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 17, 2021