Microsoft Issues Patches for Defender Zero-Day and 82 Other Windows Flaws

For the first patch Tuesday of 2021, Microsoft released security updates^[1]
addressing a total of 83 flaws spanning as many as 11 products and
services, including an actively exploited zero-day
vulnerability.

The latest security patches cover Microsoft Windows, Edge
browser, ChakraCore, Office and Microsoft Office Services, and Web
Apps, Visual Studio, Microsoft Malware Protection Engine, .NET
Core, ASP .NET, and Azure. Of these 83 bugs, 10 are listed as
Critical, and 73 are listed as Important in severity.

The most severe of the issues is a remote code execution (RCE)
flaw in Microsoft Defender (CVE-2021-1647^[2]) that could allow
attackers to infect targeted systems with arbitrary code.

Microsoft Malware Protection Engine (mpengine.dll) provides the
scanning, detection, and cleaning capabilities for Microsoft
Defender antivirus and antispyware software. The last version of
the software affected by the flaw is 1.1.17600.5, before it was
addressed in version 1.1.17700.4.

The bug is also known to have been actively exploited in the
wild, although details are scarce on how widespread the attacks are
or how this is being exploited. It’s also a zero-click flaw in that
the vulnerable system can be exploited without any interaction from
the user.

Microsoft said that despite active exploitation, the technique
is not functional in all situations and that the exploit is still
considered to be at a proof-of-concept level, with substantial
modifications required for it to work effectively.

What’s more, the flaw may already be resolved as part of
automatic updates to the Malware Protection Engine — which it
typically releases once a month or as when required to safeguard
against newly discovered threats — unless the systems are not
connected to the Internet.

“For organizations that are configured for automatic updating,
no actions should be required, but one of the first actions a
threat actor or malware will try to attempt is to disrupt threat
protection on a system so definition and engine updates are
blocked,” said Chris Goettl, senior director of product management
and security at Ivanti.

Tuesday’s patch also rectifies a privilege escalation flaw
(CVE-2021-1648^[3]) introduced by a
previous patch in the GDI Print / Print Spooler API
(“splwow64.exe”) that was disclosed by Google Project Zero^[4] last month after
Microsoft failed to rectify it within 90 days of responsible
disclosure on September 24.

Other vulnerabilities fixed by Microsoft include a memory
corruption flaws in Microsoft Edge browser (CVE-2021-1705^[5]), a Windows Remote
Desktop Protocol Core Security feature bypass flaw (CVE-2021-1674^[6], CVSS score 8.8), and
five critical RCE flaws in Remote Procedure Call Runtime.

To install the latest security updates, Windows users can head
to Start > Settings > Update & Security > Windows Update,
or by selecting Check for Windows updates.