Description:
Microsoft has released security updates addressing multiple vulnerabilities which affect several Microsoft products or components. The list of security updates can be found at:
https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Apr
In addition to the vulnerabilities in Microsoft Exchange servers, reports also indicate that a vulnerability in Desktop Window Manager (CVE-2021-28310) is being actively exploited. System administrators are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.
Affected Systems:
- Microsoft Windows 7, 8.1, RT 8.1, 10
- Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019
- Microsoft Windows Server, version 1909, version 2004, version 20H2
- Microsoft Office 2010, 2013, 2013 RT, 2016, 2019, 2019 for Mac
- Microsoft Office Online Server
- Microsoft Office Web Apps 2010, Server 2013
- Microsoft Excel 2010, 2013, 2013 RT, 2016
- Microsoft Word 2010, 2013, 2013 RT, 2016
- Microsoft Outlook 2010, 2013, 2013 RT, 2016
- Microsoft 365 Apps for Enterprise
- Microsoft Exchange Server 2013, 2016, 2019
- Microsoft SharePoint Foundation 2010
- Microsoft SharePoint Enterprise Server 2013, 2016
- Microsoft SharePoint Server 2010, 2019
- Microsoft Visual Studio 2015, 2017, 2019
- Team Foundation Server 2015, 2017, 2018
- Azure DevOps Server 2019, 2020
- Azure Sphere
- Azure ms-rest-nodeauth Library
- Raw Image Extension
- Visual Studio Code
- Visual Studio Code - GitHub Pull Requests and Issues Extension, Kubernetes Tools, Maven for Java Extension
- VP9 Video Extensions
Impact:
Depending on the vulnerability exploited, a successful attack could lead to remote code execution, elevation of privilege, information disclosure, denial of service, security feature bypass and spoofing.
Recommendation:
Patches for affected products are available from the Windows Update / Microsoft Update Catalog. Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.
More Information:
- https://msrc.microsoft.com/update-guide/en-us/releaseNote/2021-Apr
- https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-april-2021
- https://us-cert.cisa.gov/ncas/current-activity/2021/04/13/apply-microsoft-april-2021-security-update-mitigate-newly
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26413
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26415 (to CVE-2021-26417)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27064
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27067
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27072
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27079
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27086
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27088 (to CVE-2021-27096)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28309 (to CVE-2021-28358)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28434 (to CVE-2021-28454)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28456 (to CVE-2021-28460)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28464
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28466
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28468 (to CVE-2021-28473)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28475
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28477
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28480 (to CVE-2021-28483)