Weekly threat roundup: Chrome, Exchange Server, IoT devices

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Fixes for two Chrome zero-days under attack

Google has patched its Chrome web browser on Windows, Mac, and Linux with fixes for high-risk two vulnerabilities that are being actively exploited.

The two flaws are CVE-2021-21220, which is based on insufficient validation of untrusted input in the V8 JavaScript rendering engine, and CVE-2021-21206, which is a use-after-free bug in the Blink browser engine. Hackers are exploiting these two flaws to execute code in a victim’s web browser, but depending on the privileges tied with the browser, an attacker could also view, change, or delete data.

The former vulnerability was demonstrated by Dataflow Security researchers Bruno Keith and Niklas Baumstark at the Pwn2Own 2021 hacking contest, while an anonymous researcher has been credited with reporting the latter flaw to Google.

NSA find new Exchange Server vulnerabilities 

Microsoft has released patches for four newly discovered vulnerabilities in its Exchange Server systems only a few weeks after hackers were revealed to be exploiting Exchange Server bugs to target mostly on-premise data centres.

The flaws, which aren’t related to the initial attacks, apply to versions 2013, 2016, and 2019 of the operating system, and were discovered by the US National Security Agency (NSA). They include CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, and CVE-2021-28483. All four are remote code execution flaws, while the first two are pre-authentication in nature, meaning an attacker won’t need to authenticate to a vulnerable Exchange server to exploit.

The most severe is rated 9.8/10 on the CVSS threat severity scale, while another critically-rated flaw is rated 9/10, and the least severe is rated 8.8/10.

Desktop Window Manager exploit among Patch Tuesday fixes

Related Resource

The definitive guide to IT security

Protecting your MSP and your customers

The definitive guide to IT security for MSPs - whitepaper from LiongardDownload now

Alongside the four Exchange Server vulnerabilities, Microsoft this week released more than a hundred fixes across its product portfolio, including one for an actively exploited flaw in Desktop Window Manager.

Tracked as CVE-2021-28310, this escalation of privilege flaw is likely being used in a chain alongside other exploits to seize control of victims’ devices. The flaw is an out-of-bounds write vulnerability in dwmcore.dll, which is part of the Desktop Window Manager executable, according to researchers with Kaspersky’s SecureList. It's allowed attackers to execute arbitrary code, create accounts with full privileges, access or delete data and install software.

Microsoft patched 19 critical flaws and 88 tagged as being important as part of its latest wave of Patch Tuesday updates, including the four previously mentioned Exchange Server vulnerabilities.

Millions of IoT devices at risk

Nine vulnerabilities in four TCP/IP communication protocols commonly used by millions of Internet of Things (IoT) devices may lead to denial of service (DoS) or remote code execution attacks.

More than 100 million consumer and industrial IoT devices are potentially affected by the ‘Name:Wreck’ flaws, according to Forescout and JSOF researchers. The nine vulnerabilities affect the FreeBSD, Nucleus NET, IPnet, and NetX TCP/IP stacks, relating to Domain Name System (DNS) implementations, which means attackers can exploit the flaws to knock target devices offline or take complete control over them.

The researchers have recommended that developers of TCP/IP stacks review their code for any bugs and immediately fix them. FreeBSD, Nucleus NET and NetX have recently been patched, so customers should update their IoT devices immediately in order to fully protect themselves against exploitation.

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

New report highlights the need for diversity in cyber security recruitment
cyber security

New report highlights the need for diversity in cyber security recruitment

28 Apr 2021
TsuNAME vulnerability could enable DDoS attacks on major DNS servers
distributed denial of service (DDOS)

TsuNAME vulnerability could enable DDoS attacks on major DNS servers

7 May 2021
Security researchers take control of a Tesla via drone
ethical hacking

Security researchers take control of a Tesla via drone

5 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021