Cloud Platform
Platform
Solutions
Resources
Customers
Partners
Community
Support
Company
Login
Contact us
Try it
Asset Management
Vulnerability & Configuration Management
Risk Remediation
Threat Detection & Response
  • Overview

  • Platform Apps

  • Qualys Endpoint Security

    Advanced endpoint threat protection, improved threat context, and alert prioritization

  • Context XDR

    Extend detection and response beyond the endpoint to the enterprise

Compliance
Cloud Security
Cyber Risk Series | Cloud Security Edition | February 28 | Register Now

Microsoft security alert.

November 9, 2021

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 43 vulnerabilities that were fixed in 12 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 12 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft SharePoint Enterprise Server 2013 Service Pack 1 (SP1) Remote Code Execution (RCE) Vulnerability - November 2021

    Severity
    Critical 4
    Qualys ID
    110394
    Vendor Reference
    KB5002063
    CVE Reference
    CVE-2021-40442
    CVSS Scores
    Base 6.8 / Temporal 5
    Description
    Microsoft has released November 2021 security updates to fix multiple security vulnerabilities.

    This security update contains the following KBs:

    KB5002063
    QID Detection Logic:
    This authenticated QID checks the file versions from the above Microsoft KB article with the versions on the affected SharePoint system.

    Consequence
    Successful exploitation allows remote code execution.

    Solution
    Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    KB5002063

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update November 2021

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update - November 2021

    Severity
    Critical 4
    Qualys ID
    110395
    Vendor Reference
    KB4486670, KB5002032, KB5002035, KB5002038, KB5002053, KB5002056, KB5002065, KB5002072
    CVE Reference
    CVE-2021-40442, CVE-2021-41368, CVE-2021-42292, CVE-2021-42296
    CVSS Scores
    Base 6.9 / Temporal 5.7
    Description
    Microsoft has released November 2021 security updates to fix multiple security vulnerabilities.

    This security update contains the following:

    MacOS Release Notes
    Office Click-2-Run and Office 365 Release Notes
    5002072
    5002035
    5002056
    4486670
    5002038
    5002032
    5002053
    5002065

    QID Detection Logic:
    This authenticated QID checks the file versions from the Microsoft advisory with the versions on the affected office system.

    Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.

    Consequence
    Successful exploitation allows an attacker to execute code remotely.

    Solution
    Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    MacOS Release Notes
    Office Click-2-Run and Office 365 Release Notes
    5002072
    5002035
    5002056
    4486670
    5002038
    5002032
    5002053
    5002065

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update November 2021

  • Microsoft Visual Studio Code Elevation of Privilege Vulnerability - November 2021

    Severity
    Serious 3
    Qualys ID
    376026
    Vendor Reference
    CVE-2021-42322
    CVE Reference
    CVE-2021-42322
    CVSS Scores
    Base 4.6 / Temporal 3.8
    Description
    Visual Studio Code is a lightweight but powerful source code editor which runs on your desktop and is available for Windows, macOS and Linux.

    Affected Versions:
    Visual studio code prior to version 1.62.1

    QID Detection Logic(Authenticated):
    This QID checks for the vulnerable versions of Visual Studio Code.

    Consequence
    Visual Studio Code is prone to Elevation of Privilege Vulnerability.
    Solution
    Customers are advised to refer to CVE-2021-42322 for more information pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2021-42322

  • Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability - November 2021

    Severity
    Critical 4
    Qualys ID
    50116
    Vendor Reference
    KB5007409
    CVE Reference
    CVE-2021-42321
    CVSS Scores
    Base 6.5 / Temporal 5.4
    Description
    Microsoft Exchange Server Remote Code Execution Vulnerability
    KB Articles associated with this update are: KB5007409

    Affected Versions:
    Microsoft Exchange Server 2013 Cumulative Update 23
    Microsoft Exchange Server 2019 Cumulative Update 10
    Microsoft Exchange Server 2019 Cumulative Update 11
    Microsoft Exchange Server 2016 Cumulative Update 21
    Microsoft Exchange Server 2016 Cumulative Update 22

    QID Detection Logic (authenticated):
    The QID checks for the version of file Exsetup.exe.

    Consequence
    Successful exploitation allows attackers to execute remote code.
    Solution
    Customers are advised to refer to KB5007409 for information pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5007409

  • Microsoft Exchange Server Spoofing Vulnerability - November 2021

    Severity
    Critical 4
    Qualys ID
    50117
    Vendor Reference
    KB5007409
    CVE Reference
    CVE-2021-41349, CVE-2021-42305
    CVSS Scores
    Base 4.3 / Temporal 3.6
    Description
    Microsoft Exchange Server Spoofing Vulnerability
    KB Articles associated with this update are: KB5007409

    Affected Versions:
    Microsoft Exchange Server 2013 Cumulative Update 23
    Microsoft Exchange Server 2019 Cumulative Update 10
    Microsoft Exchange Server 2019 Cumulative Update 11
    Microsoft Exchange Server 2016 Cumulative Update 21
    Microsoft Exchange Server 2016 Cumulative Update 22

    QID Detection Logic (authenticated):
    The QID checks for the version of file Exsetup.exe.

    Consequence
    Successful exploitation allows attackers to perform Server Spoofing on Victim machine
    Solution
    Customers are advised to refer to KB5007409 for information pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5007409

  • Microsoft Visual Studio Security Update - November 2021

    Severity
    Critical 4
    Qualys ID
    91831
    Vendor Reference
    CVE-2021-3711, CVE-2021-42277, CVE-2021-42319
    CVE Reference
    CVE-2021-3711, CVE-2021-42277, CVE-2021-42319
    CVSS Scores
    Base 7.5 / Temporal 5.5
    Description

    Microsoft has released a security Update for Visual Studio which resolves Elevation of privilege and Remote Code Execution Vulnerabilities.
    Affected Software:
    Microsoft Visual Studio 2019 version 16.11 (includes 16.0-16.10)
    Microsoft Visual Studio 2019 version 16.9 (includes 16.0-16.8)
    Microsoft Visual Studio 2019 version 16.7 (includes 16.0-16.6)
    Microsoft Visual Studio 2017 version 15.9 (includes 15.0-15.8)
    and Microsoft Visual Studio 2015 Update 3

    Consequence

    The vulnerable versions of Visual Studio let attackers to perform Elevation of privilege and Remote Code Execution Attacks.

    Solution
    Customers are advised to refer to CVE-2021-42319, CVE-2021-42277 and, CVE-2021-3711 for more information pertaining to these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2021-3711
    CVE-2021-42277
    CVE-2021-42319
    KB5007275

  • Microsoft Windows Security Update for November 2021

    Severity
    Critical 4
    Qualys ID
    91832
    Vendor Reference
    KB5007186, KB5007189, KB5007192, KB5007205, KB5007206, KB5007207, KB5007215, KB5007233, KB5007236, KB5007245, KB5007246, KB5007247, KB5007255, KB5007260, KB5007263
    CVE Reference
    CVE-2021-26443, CVE-2021-36957, CVE-2021-38631, CVE-2021-38665, CVE-2021-38666, CVE-2021-41356, CVE-2021-41366, CVE-2021-41367, CVE-2021-41370, CVE-2021-41371, CVE-2021-41377, CVE-2021-41378, CVE-2021-41379, CVE-2021-42274, CVE-2021-42275, CVE-2021-42276, CVE-2021-42277, CVE-2021-42279, CVE-2021-42280, CVE-2021-42283, CVE-2021-42284, CVE-2021-42285, CVE-2021-42286, CVE-2021-42288
    CVSS Scores
    Base 7.7 / Temporal 6.4
    Description
    Microsoft releases the security update for Windows November 2021

    The KB Articles associated with the update:
    KB5007192
    KB5007207
    KB5007206
    KB5007186
    KB5007189
    KB5007205
    KB5007215
    KB5007247
    KB5007255
    KB5007260
    KB5007245
    KB5007236
    KB5007233
    KB5007263
    KB5007246

    This QID checks for the file version of ntoskrnl.exe

    The following versions of ntoskrnl.exe with their corresponding KBs are verified:
    KB5007192 -10.0.14393.4770
    KB5007207- 10.0.10240.19119
    KB5007206-10.0.17763.2300
    KB5007186-10.0.19041.1348
    KB5007189-10.0.18362.1916
    KB5007205-10.0.20348.350
    KB5007215-10.0.22000.318
    KB5007247-6.3.9600.20173
    KB5007255-6.3.9600.20173
    KB5007260-6.2.9200.23516
    KB5007245-6.2.9200.23516
    KB5007236-6.1.7601.25767
    KB5007233-6.1.7601.25767
    KB5007263-6.0.6003.21280
    KB5007246-6.0.6003.21280

    Consequence
    Successful exploit could compromise Confidentiality, Integrity and Availability

    Solution
    Please refer to the KB5007192
    KB5007207
    KB5007206
    KB5007186
    KB5007189
    KB5007205
    KB5007215
    KB5007247
    KB5007255
    KB5007260
    KB5007245
    KB5007236
    KB5007233
    KB5007263
    KB5007246

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5007186
    KB5007189
    KB5007192
    KB5007205
    KB5007206
    KB5007207
    KB5007215
    KB5007233
    KB5007236
    KB5007245
    KB5007246
    KB5007247
    KB5007255
    KB5007260
    KB5007263

  • Microsoft Dynamics 365 Security Update - November 2021

    Severity
    Serious 3
    Qualys ID
    91833
    Vendor Reference
    CVE-2021-42316
    CVE Reference
    CVE-2021-42316
    CVSS Scores
    Base 6.5 / Temporal 4.8
    Description
    Microsoft Dynamics 365 is a product line of enterprise resource planning and customer relationship management intelligent business applications.

    CVE-2021-42316:Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability

    Affected Software:
    Microsoft Dynamics 365(on-premise) version 9.0
    Microsoft Dynamics 365(on-premise) version 9.1

    QID Detection Logic(Authenticated):
    This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file Microsoft.Crm.Setup.Server.exe:

    Consequence
    Successful exploitation of this vulnerability can result into remote code execution.
    Solution
    Customers are advised to refer to CVE-2021-42316 for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2021-42316

  • Microsoft 3D Viewer Remote Code Execution (RCE) Vulnerability - November 2021

    Severity
    Critical 4
    Qualys ID
    91834
    Vendor Reference
    CVE-2021-43208, CVE-2021-43209
    CVE Reference
    CVE-2021-43208, CVE-2021-43209
    CVSS Scores
    Base 6.8 / Temporal 5
    Description
    Microsoft 3D Viewer is prone to Remote Code Execution Vulnerability.

    Affected Versions:
    Microsoft 3D-Viewer App package versions prior to 7.2107.7012.0

    QID Detection Logic (Authenticated):
    The detection gets the version of Microsoft.Microsoft3DViewer by querying wmi class Win32_InstalledStoreProgram.

    Consequence
    Successful exploitation allows an attacker to execute code remotely.
    Solution
    Users are advised to check CVE-2021-43208 and CVE-2021-43209 for more information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2021-43208
    CVE-2021-43209

  • Microsoft Active Directory Domain Services (AD DS) Elevation of Privilege Vulnerability - November 2021

    Severity
    Critical 4
    Qualys ID
    91835
    Vendor Reference
    KB5007186, KB5007192, KB5007205, KB5007206, KB5007233, KB5007236, KB5007245, KB5007246, KB5007247, KB5007255, KB5007260, KB5007263
    CVE Reference
    CVE-2021-42278, CVE-2021-42282, CVE-2021-42287, CVE-2021-42291
    CVSS Scores
    Base 6.5 / Temporal 5.4
    Description
    Microsoft releases the security update for Windows November 2021

    The KB Articles associated with the update:
    KB5007192
    KB5007206
    KB5007186
    KB5007205
    KB5007247
    KB5007255
    KB5007260
    KB5007245
    KB5007236
    KB5007233
    KB5007263
    KB5007246

    This QID checks for the file version of ntoskrnl.exe

    The following versions of ntoskrnl.exe with their corresponding KBs are verified:
    KB5007192 -10.0.14393.4770
    KB5007206-10.0.17763.2300
    KB5007186-10.0.19041.1348
    KB5007205-10.0.20348.350
    KB5007247-6.3.9600.20173
    KB5007255-6.3.9600.20173
    KB5007260-6.2.9200.23516
    KB5007245-6.2.9200.23516
    KB5007236-6.1.7601.25767
    KB5007233-6.1.7601.25767
    KB5007263-6.0.6003.21280
    KB5007246-6.0.6003.21280

    Consequence
    Successful exploit could compromise Confidentiality, Integrity and Availability

    Solution
    Please refer to the KB5007192
    KB5007206
    KB5007186
    KB5007205
    KB5007247
    KB5007255
    KB5007260
    KB5007245
    KB5007236
    KB5007233
    KB5007263
    KB5007246

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB5007186
    KB5007192
    KB5007205
    KB5007206
    KB5007233
    KB5007236
    KB5007245
    KB5007246
    KB5007247
    KB5007255
    KB5007260
    KB5007263

  • Microsoft Windows Defender Remote Code Execution (RCE) Vulnerability - November 2021

    Severity
    Critical 4
    Qualys ID
    91836
    Vendor Reference
    CVE-2021-42298
    CVE Reference
    CVE-2021-42298
    CVSS Scores
    Base 9.3 / Temporal 7.3
    Description
    Microsoft Defender is prone to Remote Code Execution (RCE) Vulnerability.

    Affected Software:
    Windows Defender

    QID Detection Logic (Authenticated):
    Detection checks for mpengine.dll file version less than 1.1.18700.3

    Consequence
    Successful exploitation allows attacker to compromise the system.

    Solution
    Users are advised to check CVE-2021-42298 for more information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2021-42298

  • Microsoft Power BI Report Server Spoofing Vulnerability - November 2021

    Severity
    Serious 3
    Qualys ID
    91837
    Vendor Reference
    CVE-2021-41372
    CVE Reference
    CVE-2021-41372
    CVSS Scores
    Base 6.8 / Temporal 5
    Description
    A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim.

    Affected Versions:
    Power BI Report Server (September 2021)
    QID Detection Logic:
    This authenticated QID detects vulnerable versions of RSHostingService.exe by fetching the service installed path from the HKLM\SYSTEM\CurrentControlSet\Services\PowerBIReportServer registry key.

    Consequence
    Successful exploitation allows an attacker to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded.

    Solution
    Customers are advised to refer to CVE-2021-41372 for more information pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CVE-2021-41372

These new vulnerability checks are included in Qualys vulnerability signature 2.5.326-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 110394
    • 110395
    • 376026
    • 50116
    • 50117
    • 91831
    • 91832
    • 91833
    • 91834
    • 91835
    • 91836
    • 91837
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.