Weekly threat roundup: Microsoft, Adobe, Wi-Fi gadgets

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, we have collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Microsoft patches three zero-days 

A zero-day flaw in the beleaguered Exchange Server platform was among the 55 vulnerabilities Microsoft fixed as part of its latest Patch Tuesday round of security updates.

The flaw, tracked as CVE-2021-31207, is present in the same platform that was at the heart of a devastating supply chain attack earlier in the year, although it hasn’t yet been exploited by cyber criminals. It’s described as a security feature bypass flaw and was discovered as part of last month’s Pwn2Own contest.

This has been fixed alongside two other zero-day vulnerabilities. These are an elevation of privilege flaw in .NET and Visual Studio, tagged CVE-2021-31204, and a remote code execution flaw in Microsoft's Common Utilities component, tagged CVE-2021-31200.

Adobe fixes Reader bug under attack

Adobe’s Patch Tuesday included multiple fixes for 12 different products, including a zero-day flaw in Adobe Reader that’s under attack.

CVE-2021-28550, in Adobe Reader, is a user after free bug that has led to reports of remote code execution attacks against Windows users. However, the bug also affects Adobe deployments on macOS machines, although exploitation hasn’t yet been detected. This vulnerability was fixed alongside bugs in Adobe Experience Manager, InDesign, InCopy, Genuine Service, Acrobat, Magento, Media Encoder, After Effects, Medium, Animate, and the Creative Cloud Desktop.

Of the 14 flaws, 11 could have been exploited to launch remote code execution attacks, while the other three were described as a memory leak, arbitrary file system read and privilege escalation flaw.

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastDownload now

WordPress patches critical object injection flaw

WordPress has fixed a critical vulnerability with version 5.7.2 that’s been described as an object injection flaw in PHPMailer, which is a code library used to send emails using PHP code from a web server.

Rated 9.8 on the CVSS threat severity scale, the flaw, known as CVE-2020-36326, could have allowed an attacker to perform a variety of attacks, such as code injection, SQL injection and denial of service. This would have put many websites at risk of compromise.

For WordPress users who haven’t updated to 5.7, all versions since 3.7 have also been updated automatically to fix the security flaw.

“Frag attacks” targeting Wi-Fi devices

Millions of Wi-Fi devices manufactured over the last 20 years are embedded with vulnerabilities that hackers can exploit to steal data or take control of smart home devices.

According to security researcher Mathy Vanhoef, “frag attacks” are present in the Wi-Fi Protected Access 3 (WPA3) protocol, which is the most up-to-date Wi-Fi security protocol available. To exploit the collection of design flaws, an attacker within radio range of a targeted device can inject frames into a protected network, which can be abused to intercept traffic, by, for instance, tricking the user into using a malicious DNS server.

There are 12 vulnerabilities in total. Vanhoef has informed the Wi-Fi Alliance of his discovery of these “frag attacks., and device manufacturers are now developing fixes, according to the Industry Consortium for Advancement of Security on the Internet (ICASI).

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021
Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition
mergers and acquisitions

Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition

14 Sep 2021