After Log4j, December Patch Tuesday piles on the stress

Microsoft launched its month-to-month Patch Tuesday replace as per its schedule on 14 November, and with safety groups nonetheless assessing the fall-out from the Log4Shell Apache Log4j vulnerability (CVE-2021-44228)  – in all probability essentially the most impactful safety disclosure since Heartbleed – defenders are coming beneath rising stress and danger burning out.

Microsoft’s December replace included fixes for 67 distinctive widespread vulnerabilities and exposures (CVEs), seven of them rated vital, six already being actively exploited, together with a zero-day that’s getting used to unfold the newly reinvigorated Emotet.

However with the previous 24 hours additionally seeing patch drops from Adobe, Apple, Cisco, Google Chrome, SAP and VMware, Calvin Gan of F-Safe’s Tactical Defence Unit mentioned there was a transparent danger that safety groups are by now changing into overwhelmed.

“Defenders are battling in opposition to time in patching affected methods, which isn’t as direct as merely upgrading, whereas additionally keeping off exploitation makes an attempt which have been rising in current days,” mentioned Gan.

“The benefit of executing the [Log4j] exploit meant that the time to patch has been considerably shorter, mixed with the completely different mass scanning makes an attempt on the web by varied entities, making it a lot tougher for defenders to comb by the logs and determine potential breaches.

“Whereas the total impression is presently unknown, it’s anticipated that organisations must have interaction all accessible sources and work extra time to mitigate this vulnerability, whereas blocking potential assaults.” 

Ivanti’s Chris Goettl added: “Anticipate lots of consideration to be centered on distributors scrambling to resolve Log4j-related points, however that mentioned, don’t lose sight of further Patch updates from Microsoft.

“Efforts to determine, mitigate or remediate the Apache Log4j vulnerability proceed. On this case it’s leaving lots of groups annoyed, not figuring out precisely what they should do. The very best steering is to proceed to depend on your DevSecOps processes and vulnerability scanning, and complement this with extra direct motion as there’ll doubtless be gaps for a while in detection.”

Kev Breen, director of cyber risk analysis at Immersive Labs, mentioned: “I count on many safety groups shall be closely invested in a Log4j decision – however that doesn’t cease the world from turning. As all the time, you recognize your dangers and your property, so you must make patching and replace choices accordingly. Take a breath, take a look at the discharge from Microsoft, and prioritise or deprioritise accordingly.”

Of the 67 Microsoft CVEs, in all probability essentially the most worthy of fast consideration is CVE-2021-43890. That is the abovementioned zero-day, a spoofing vulnerability in Home windows AppX Installer which, in accordance with Microsoft, has been used to unfold malware within the Emotet/Trickbot/Bazarloader household.

Dustin Childs of the Zero Day Initiative defined: “An attacker would want to craft a malicious attachment for use in phishing campaigns. The attacker would then should persuade the person to open the specifically crafted attachment. It appears code execution would happen on the logged-on person stage, so attackers would doubtless mix this with one other bug to take management of a system.”

Additionally attracting consideration this month is CVE-2021-43883, an elevation-of-privilege vulnerability in Home windows Installer, which is considerably uncommon in that it appears be a repair for a bypass of a bug that was already mounted in November – CVE-2021-41379. Caitlin Condon, engineering supervisor at Rapid7, defined: “Whereas there isn’t a indication within the advisory that the 2 vulnerabilities are associated, CVE-2021-43883 appears to be like an terrible lot just like the repair for a zero-day vulnerability that made a splash within the safety group final month after proof-of-concept exploit code was launched and in-the-wild assaults started.

“The zero-day vulnerability, which researchers hypothesised was a patch bypass for CVE-2021-41379, allowed low-privileged attackers to overwrite protected recordsdata and escalate to SYSTEM. Rapid7’s vulnerability analysis workforce did a full root-cause evaluation of the bug as assaults ramped up in November.”

The opposite vital vulnerabilities within the Microsoft replace are all distant code execution (RCE) vulnerabilities. These are CVE-2021-42310 in Microsoft Defender for IoT, CVE-2021-43215 in iSNS Server, CVE-2021-43217 in Home windows Encrypting File System, CVE-2021-43233 in Distant Desktop Shopper, CVE-2021-43899 in Microsoft 4K Wi-fi Show Adapter, CVE-2021-43905 in Microsoft Workplace app, and CVE-2021-43907 in Visible Studio Code WSL Extension.