{"id":8703,"date":"2021-04-16T07:04:57","date_gmt":"2021-04-16T14:04:57","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8703"},"modified":"2023-03-03T14:37:36","modified_gmt":"2023-03-03T21:37:36","slug":"march-microsoft-patches-89-security-vulnerabilities","status":"publish","type":"patch_watch","link":"https:\/\/10.42.32.162\/patch_watch\/march-microsoft-patches-89-security-vulnerabilities\/","title":{"rendered":"March: Microsoft patches 89 security vulnerabilities"},"content":{"rendered":"<p dir=\"ltr\">Microsoft patched 89 unique security vulnerabilities in March 2021. We analyzed these weaknesses and spotlighted important vulnerabilities that ought to be patched on priority.<\/p>\n<h2 dir=\"ltr\"><img decoding=\"async\" style=\"width: 800px; height: 389px;\" src=\"\/wp-content\/uploads\/2015\/11\/microsoft-march-patches-2021-1.png\" alt=\"\" \/><\/h2>\n<h2 dir=\"ltr\"><strong>Microsoft\u2019s March Patches Overview<\/strong><\/h2>\n<p dir=\"ltr\">In March, Microsoft patched 89 vulnerabilities discovered in 2021 &#8211;<\/p>\n<p dir=\"ltr\"><strong>RCE\/PE:\u00a0<\/strong>Remote Code Execution and Privilege Execution are two of the most dangerous weaknesses that are most exploited by malicious actors. Microsoft has fixed &#8211;<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">45 CVEs that have been classified as RCE bugs<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">30 CVEs have Privilege Escalation capabilities<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">4 CVEs are linked to Denial of Service<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\">Notably four CVEs (CVE-2021-27065, CVE-2021-26855, CVE-2021-26863, CVE-2021-21300) have publicly known exploits therefore patching them would be essential.<\/p>\n<p dir=\"ltr\"><strong>Zero Day Vulnerabilities:<\/strong> Microsoft has released out-of-band patches for four Zero Day Vulnerabilities ( CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).<\/p>\n<p dir=\"ltr\">These weaknesses exist in Microsoft exchange server and have been associated with Hafnium, Winnti Group, Tick, LuckyMouse, Websiic, Calypso, Tonto Team, Mikroceen, and Vicious Panda APT group.<\/p>\n<p>These CVEs are also being exploited by DearCry Ransomware and are being delivered through PlugX and ShadowPad malware.<\/p>\n<h2><strong>CISA Alerts<\/strong><\/h2>\n<p dir=\"ltr\">Six CVEs have featured in recent CISA alerts (CVE-2021-26869, CVE-2021-27065, CVE-2021-26857, CVE-2021-26855, CVE-2021-26858, CVE-2021-26867)<\/p>\n<p dir=\"ltr\">These CVEs have been red flagged by security agencies primarily because these vulnerabilities are associated with DearCry ransomware and APT groups (Hafnium, Winnti Group, Tick, LuckyMouse, Websiic, Calypso, Tonto Team, Mikroceen -Vicious Panda Group) are exploiting it to mount cyber attacks.<\/p>\n<h2><strong>Product Analysis<\/strong><\/h2>\n<p>Patches are released for 47 different Microsoft products.<\/p>\n<p><img decoding=\"async\" style=\"width: 800px; height: 295px;\" src=\"\/wp-content\/uploads\/2015\/11\/product-analysis-horizontal.jpg\" alt=\"\" \/><\/p>\n<h2><strong>Severity Scores<\/strong><\/h2>\n<p dir=\"ltr\"><img decoding=\"async\" src=\"https:\/\/lh4.googleusercontent.com\/fQmdOQ9esUdoePUxoPS4qvKt8Bl8aqyN6gBGX_8Ezs7W9SolPUegF5YLEd_k0Fx6crsrIhi_fbvE4bJYLdFyFZwb7qCFTdJeqB6JzYhXsvvqWFgbcsV4T3tAPcvZLyX59464Ujch\" width=\"518\" height=\"376\" \/><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrrcwJ1CK9DUa1iy?backgroundColor=cyan&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h6><strong>Table: Microsoft March Patches 2021<\/strong><\/h6>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Newly discovered vulnerabilities are fast becoming weaponized and are becoming arsenal for ransomware families and APT groups. Prioritize your patching and shrink your attack surface.<\/p>\n<p dir=\"ltr\">\n<p><code><\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft patched 89 unique security vulnerabilities in March 2021. We analyzed these weaknesses and spotlighted important vulnerabilities that ought to be patched on priority. Microsoft\u2019s March Patches Overview In March, Microsoft patched 89 vulnerabilities discovered in 2021 &#8211; RCE\/PE:\u00a0Remote Code Execution and Privilege Execution are two of the most dangerous weaknesses that are most exploited [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14440,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[290],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch\/8703"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/14440"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=8703"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_category?post=8703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}