Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe
  • Twitter
  • Facebook
  • LinkedIn

Microsoft’s November 2021 Patch Tuesday Addresses 55 CVEs (CVE-2021-42321)

Microsoft’s November 2021 Patch Tuesday Addresses 55 CVEs (CVE-2021-42321)
  1. 6Critical
  2. 49Important
  3. 0Moderate
  4. 0Low

Microsoft patched 55 CVEs in the November 2021 Patch Tuesday release, including six rated as critical, and 49 rated as important.

This month’s update includes patches for:

  • 3D Viewer
  • Azure
  • Azure RTOS
  • Azure Sphere
  • Microsoft Dynamics
  • Microsoft Edge (Chromium-based)
  • Microsoft Edge (Chromium-based) in IE Mode
  • Microsoft Exchange Server
  • Microsoft Office
  • Microsoft Office Access
  • Microsoft Office Excel
  • Microsoft Office SharePoint
  • Microsoft Office Word
  • Microsoft Windows
  • Microsoft Windows Codecs Library
  • Power BI
  • Role: Windows Hyper-V
  • Visual Studio
  • Visual Studio Code
  • Windows Active Directory
  • Windows COM
  • Windows Core Shell
  • Windows Cred SSProvider Protocol
  • Windows Defender
  • Windows Desktop Bridge
  • Windows Diagnostic Hub
  • Windows Fastfat Driver
  • Windows Feedback Hub
  • Windows Hello
  • Windows Installer
  • Windows Kernel
  • Windows NTFS
  • Windows RDP
  • Windows Scripting
  • Windows Virtual Machine Bus

Elevation of privilege (EoP) vulnerabilities accounted for 36.4% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 27.3%.

Important

CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-42321 is a RCE vulnerability in Microsoft Exchange Server. The flaw exists due to the improper validation of command-let (cmdlet) arguments. To exploit this vulnerability, an attacker would need to be authenticated to a vulnerable Exchange Server. Microsoft says they are aware of “limited targeted attacks” using this vulnerability in the wild. Additionally, this appears to be the same vulnerability in Exchange Server that was exploited at the Tianfu Cup, a Chinese cybersecurity contest.

Several notable vulnerabilities have been disclosed in Microsoft Exchange Server throughout 2021, starting with ProxyLogon and associated zero-days in March, later followed by ProxyShell. Organizations that run Exchange Server on-premises should apply security updates in a timely manner to prevent future exploitation once proof-of-concept code becomes publicly available.

Important

CVE-2021-42292 | Microsoft Excel Security Feature Bypass Vulnerability

CVE-2021-42292 is a security feature bypass zero-day in Microsoft Excel that received a 7.8 CVSSv3 score and has been exploited in the wild. Discovery of this flaw is credited to the Microsoft Threat Intelligence Center (MSTIC) but no further information on the vulnerability or the detected exploitations has been published at this time. Microsoft specifically notes that the Preview Pane is not an attack vector for this vulnerability, which means the victim would need to open a malicious Excel document for exploitation to occur. Microsoft notes that patches for Office for Mac are still in progress.

Critical

CVE-2021-38666 | Remote Desktop Client Remote Code Execution Vulnerability

CVE-2021-38666 is a RCE vulnerability in the Remote Desktop Client that received a CVSSv3 score of 8.8. The vulnerability can be exploited when a victim machine connects to an attacker-controlled Remote Desktop server, allowing the attacker to execute arbitrary code on the victim's machine. While no public exploit appears to exist at this time, Microsoft has designated this flaw as “Exploitation More Likely” according to Microsoft’s Exploitability Index.

Microsoft also provided two other patches for Windows Remote Desktop Protocol (RDP) this month which could be used in a related scenario. If an attacker is able to take control of an account with RDP server administrator privileges, they could exploit CVE-2021-41371 or CVE-2021-38631 to read Windows RDP client passwords. Both CVE-2021-41371 and CVE-2021-38631 were publicly disclosed, according to Microsoft.

The attacker would need to control a Remote Desktop server prior to exploitation of any one of these three CVEs.

Important

CVE-2021-43208 and CVE-2021-43209 | 3D Viewer Remote Code Execution Vulnerability

CVE-2021-43208 and CVE-2021-43209 are RCE vulnerabilities found in 3D Viewer, a 3D object viewer and augmented reality application for Windows. According to Microsoft, these vulnerabilities have both been publicly disclosed and are attributed to Mat Powell of Trend Micro Zero Day Initiative. While no additional details are available at this time, Microsoft’s advisory does note that affected customers should receive updates automatically from the Microsoft Store. Customers that have automatic updates disabled will have to take action in order to receive this update.

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains November 2021.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s November 2021 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now
Tenable.io FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.