Microsoft Patch Tuesday, February 2021 Edition
Summary: Microsoft released updates addressing at least 56 security holes in Windows and other software, nine of them rated critical, with one flaw (CVE-2021-1732) already exploited in the wild and six publicized before the release. A critical DNS server bug affecting Windows Server 2008 through 2019, CVE-2021-24078, carries a CVSS score of 9.8 and could let an attacker remotely install software of their choice.
Why it matters: CVE-2021-24078 can be triggered by getting a vulnerable DNS server to query a domain it has not seen before, and Kevin Breen of Immersive Labs notes it could let an attacker redirect an organization's web traffic to a malicious server. Microsoft is also enforcing the second phase of its Zerologon fix, which begins rejecting insecure Netlogon attempts from non-Windows devices.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-1472CVE-2021-1732CVE-2021-21148CVE-2021-24078
- Related
- CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-1732: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-21148: Google Chromium V8 Heap Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021