On June 8, 2021, Microsoft released security updates for clients and Windows, Office, etc. servers. - as well as for other products.
The June 2021 Patch Tuesday release fixes 49 CVEs, five of which are rated critical.
This is the third time in 2021 that Microsoft has corrected less than 60 CVEs, and the June updates contain the lowest number of updates per month for this year. However, users and administrators should install the June updates as soon as possible.
This is because Microsoft has fixed six 0day vulnerabilities that have already been exploited in practice. These include four rights-raising vulnerabilities, one data disclosure vulnerability and one remote code execution.
CVE-2021-33742 is a remote code execution vulnerability in the Microsoft Windows MSHTML platform. Although this vulnerability does not require special privileges, the attack complexity to exploit it is high. This means that an attacker would have to do additional work to successfully exploit this vulnerability. However, this appears to have already happened, although in practice the details of how the vulnerability could be exploited are not yet known.
CVE-2021-31955 is a vulnerability in the Windows kernel that can be exploited to cause data disclosure, while CVE-2021-31956 is a vulnerability in Windows NTFS that allows privilege escalation. Details on how these vulnerabilities could be exploited in practice are not yet known. However, both require the attacker to be authenticated to the target system.
CVE-2021-33739 is a 0day privilege vulnerability in the Microsoft Desktop Window Manager (DWM) Library. In comparison, Microsoft addressed two privilege vulnerabilities in February (CVE-2021-1732) and April (CVE-2021-28310) that appear to come from a group known as BITTER APT.
Following this news, it would be good to proceed with the installation of the updates. To date, no errors have been reported since installing the updates.
George is still wondering what he is doing here….
