VERT Threat Alert: July 2021 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s July 2021 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-954 on Wednesday, July 14th.

In-The-Wild & Disclosed CVEs

CVE-2021-34527

The vulnerability dubbed PrintNightmare was patched prior to the Tuesday patch drop, but it is still worth including here. This vulnerability also generated a bit of confusion. There is confusion around the CVE associated with the vulnerability. CVE-2021-1675 was patched in June and the PrintNightmare proof of concept worked on systems with that update. Articles indicated that the patch was broken or it had been bypassed, but Microsoft clarified this in the FAQ for CVE-2021-34527. This vulnerability is distinct from CVE-2021-1675 and existed before the June patch, which is why we now have two CVEs and a lot of confusion in discussions around PrintNightmare.

The vulnerability itself allows an authenticated user to execute code as SYSTEM and as such there are concerns that it could be incorporated into malware for the purpose of lateral movement. It is important to note that there is a registry key that could return a system to a vulnerable state. Additionally, this vulnerability has been publicly disclosed and has been actively exploited.

Microsoft has rated this as Exploitation Detected on the latest software release on the Exploitability Index.

CVE-2021-33771

This CVE describes an actively exploited elevation of privilege vulnerability in the Windows kernel.

Microsoft has rated this as Exploitation Detected on the latest software release on the Exploitability Index.

CVE-2021-34448

In order to exploit this vulnerability in a scripting engine, a user would have to visit a malicious page or open a specially crafted file. This vulnerability has seen active exploitation.

Microsoft has rated this as Exploitation Detected on the latest software release on the Exploitability Index.

CVE-2021-31979

This CVE describes an actively exploited elevation of privilege vulnerability in the Windows kernel.

Microsoft has rated this as Exploitation Detected on the latest software release on the Exploitability Index.

CVE-2021-34473

This code execution vulnerability affects Microsoft Exchange Server 2013, 2016, and 2019 and has been publicly disclosed but is not currently seeing active exploitation. It is important to note that this vulnerability was actually patched in the April patch drop, but Microsoft forgot to include it in the April 2021 Security Updates.

Microsoft has rated this as Exploitation More Likely on the latest software release on the Exploitability Index.

CVE-2021-34492

This vulnerability describes a publicly disclosed certificate spoofing vulnerability that impacts all modern Microsoft platforms.

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE-2021-34523

This elevation of privilege vulnerability affects Microsoft Exchange Server 2013, 2016, and 2019 and has been publicly disclosed but is not currently seeing active exploitation. It is important to note that this vulnerability was actually patched in the April patch drop, but Microsoft forgot to include it in the April 2021 Security Updates.

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE-2021-33779

A publicly disclosed bypass in Windows ADFS resolved by this update. The vulnerability is related to Primary Refresh Tokens stored in TPM. The tokens are used for SSO with AzureAD and prior to this update are stored with weak encryption that could potentially allow a malicious administrator to extract and decrypt the tokens.

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE-2021-33781

A publicly disclosed vulnerability that allows the bypass of an Active Directory security feature is resolved with this vulnerability.

Microsoft has rated this as Exploitation Less Likely on the latest software release on the Exploitability Index.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis.

Other Information

There was an update to an existing advisory in the July security guidance.

Microsoft Guidance for Addressing Security Feature Bypass in GRUB [ADV200011]

Microsoft has updated ADV200011 with details around vulnerabilities that were patched in March related to the “There’s a Hole in the Boot” vulnerability that allowed for Secure Boot bypass with GRUB.

Kerberos KDC Security Feature Bypass Vulnerability [CVE-2020-17049]

Microsoft has released version 6 of this security guidance as the default settings have now changed to Enforcement mode. It is now required that all domain controllers have the December update installed. The PerformTicketSignature registry key setting is now ignored and you cannot override Enforcement mode. You can find more details in KB4598347.