Randy Franklin Smith's Ultimate Windows Security

Upcoming Webinars

Why Traditional AV is failing: A Detailed Look into Obfuscation and Evasion Techniques That Fool Traditional AV
Implementing an Email Security Strategy Using the MITRE ATT&CK Framework

Webinar Library

Latest Blogs

Recent Security Features in Active Directory You Probably Aren't Using

Active Directory security features you probably aren’t using and more in my sessions at The Experts Conference 2019

How to Detect Pass-the-Hash Attacks Blog Series

Come meet Randy in Orlando at Microsoft Ignite at Quest's Booth #1818

Detecting Pass-the-Hash with Honeypots

Catch Malware Hiding in WMI with Sysmon

For of all sad words of tongue or pen, the saddest are these: 'We weren’t logging’

Experimenting with Windows Security: Controls for Enforcing Policies

Sysmon Event IDs 1, 6, 7 Report All the Binary Code Executing on Your Network

Yet Another Ransomware Can That Can be Immediately Detected with Process Tracking on Workstations

Top Resources

Security Log

Additional Resources

January, 2021: Patch Tuesday: One Vulnerability Exploited in the Wild

Welcome to this January Patch Tuesday Bulletin. This month there are 83 unique CVE’s affecting 10 technologies, 4 technologies with critical vulnerabilities, 1 exploited technology, and 1 technology with publicly disclosed vulnerability details. CVE-2021-1647 was exploited in the wild and affects the Malware Protection Engine but updates are applied automatically. CVE-2021-1648 was publicly disclosed and is a privilege escalation vulnerability in Windows but Microsoft states that exploitation is less likely. Microsoft does rate CVE-2021-1709 and CVE-2021-1707 as more likely to be exploited so make sure that these vulnerabilities are remediated. CVE-2021-1709 is an elevation of privilege vulnerability affecting Windows and CVE-2021-1707 is a remote code execution vulnerability affecting SharePoint.

Over the years we've had millions of visitors to UltimateWindowsSecurity.com. Every month we have thousands and thousands of visitors to our Security Log Encyclopedia which documents all of the Security Log event ID’s for Windows Server OS’s. Back in 2007 when SharePoint added auditing capability, I realized that my audience not only needed the event information from SharePoint but I also found a similar need in SQL Server and Exchange. So not only did I document the data but I also started to develop the means to extract that event data from these applications so that it’s accessible and useable to the end user. Some 8 years later and LOGbinder is continuing to grow as companies realize LOGbinder bridges the gap between these applications and their infosec team. Visit LOGbinder.com to download a free 30-day fully functional trial and see the security event data that you have literally been missing.

So, without further ado, here’s the chart of MS patches this month.

Patch data provided by:

Technology

Products Affected

Severity

Reference

Workaround/ Exploited

Vulnerability Info

Windows

Remote Desktop

Remote Desktop Client for Windows Desktop

Windows 8.1, RT 8.1, 10

Server 2012, 2016, 2019

Critical

*Workaround: No

**Public: Yes

Exploited: No

Denial of Service

Elevation of Privilege

Information Disclosure

Remote Code Execution

Security Feature Bypass

Edge

EdgeHTML-based

Critical

CVE-2021-1705

*Workaround: No

**Public: No

Exploited: No

Remote Code Execution

Office, Office Services, and Web Apps

365 Apps for Enterprise

Excel 2010, 2013, 2016

Office 2010, 2013, 2016, 2019, 2019 for Mac, Online Server

Web Apps 2010, server 2013

SharePoint Enterprise Server 2013, 2016

SharePoint Foundation 2010, 2013

SharePoint Server 2010, 2019

Word 2010, 2013, 2016

Important

CVE-2021-1719

*Workaround: No

**Public: No

Exploited: No

Remote Code Execution

Windows Codecs Library

HEVC Video Extension

Critical

CVE-2021-1644

CVE-2021-1643

*Workaround: No

**Public: No

Exploited: No

Remote Code Execution

Visual Studio

Visual Studio 2015, 2017, 2019

Important

*Workaround: No

**Public: No

Exploited: No

Denial of Service

Elevation of Privilege

Remote Code Execution

SQL Server

SQL Server 2012, 2014, 2016, 2017, 2019

Important

CVE-2021-1636

*Workaround: No

**Public: No

Exploited: No

Elevation of Privilege

Malware Protection Engine

Security Essentials

System Center 2012, Endpoint Protection

Defender

Critical

CVE-2021-1647

*Workaround: No

**Public: No

Exploited: Yes

Remote Code Execution

.NET Repository

.NET 4.6.0 - 4.10.2

Important

CVE-2021-1725

*Workaround: No

**Public: No

Exploited: No

Information Disclosure

ASP .NET

ASP.NET Core 3.1, 5.0

Important

CVE-2021-1723

*Workaround: No

**Public: No

Exploited: No

Denial of Service

Azure

Azure Kubernetes Service

Important

CVE-2021-1677

*Workaround: No

**Public: No

Exploited: No

Spoofing

Send me this chart next Patch Tuesday.

Home

User name:
Password:
	/ Forgot?
	Register

January 2021 Patch Tuesday	"Patch Tuesday: One Vulnerability Exploited in the Wild " - sponsored by LOGbinder

Follow @randyfsmith

Home

Follow @randyfsmith

About | Newsletter | Contact

Ultimate Windows Security is a division of Monterey Technology Group, Inc. ©2006-2021 Monterey Technology Group, Inc. All rights reserved.
Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. For complaints, please contact abuse@ultimatewindowssecurity.com.