Microsoft security alert.
November 9, 2021
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 43 vulnerabilities that were fixed in 12 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 12 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft SharePoint Enterprise Server 2013 Service Pack 1 (SP1) Remote Code Execution (RCE) Vulnerability - November 2021
- Severity
- Critical 4
- Qualys ID
- 110394
- Vendor Reference
- KB5002063
- CVE Reference
- CVE-2021-40442
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Microsoft has released November 2021 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB5002063
QID Detection Logic:
This authenticated QID checks the file versions from the above Microsoft KB article with the versions on the affected SharePoint system. - Consequence
-
Successful exploitation allows remote code execution.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Office and Microsoft Office Services and Web Apps Security Update November 2021
-
Microsoft Office and Microsoft Office Services and Web Apps Security Update - November 2021
- Severity
- Critical 4
- Qualys ID
- 110395
- Vendor Reference
- KB4486670, KB5002032, KB5002035, KB5002038, KB5002053, KB5002056, KB5002065, KB5002072
- CVE Reference
- CVE-2021-40442, CVE-2021-41368, CVE-2021-42292, CVE-2021-42296
- CVSS Scores
- Base 6.9 / Temporal 5.7
- Description
-
Microsoft has released November 2021 security updates to fix multiple security vulnerabilities.
This security update contains the following:
MacOS Release Notes
Office Click-2-Run and Office 365 Release Notes
5002072
5002035
5002056
4486670
5002038
5002032
5002053
5002065QID Detection Logic:
This authenticated QID checks the file versions from the Microsoft advisory with the versions on the affected office system.Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.
- Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
MacOS Release Notes
Office Click-2-Run and Office 365 Release Notes
5002072
5002035
5002056
4486670
5002038
5002032
5002053
5002065Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Office and Microsoft Office Services and Web Apps Security Update November 2021
-
Microsoft Visual Studio Code Elevation of Privilege Vulnerability - November 2021
- Severity
- Serious 3
- Qualys ID
- 376026
- Vendor Reference
- CVE-2021-42322
- CVE Reference
- CVE-2021-42322
- CVSS Scores
- Base 4.6 / Temporal 3.4
- Description
-
Visual Studio Code is a lightweight but powerful source code editor which runs on your desktop and is available for Windows, macOS and Linux.
Affected Versions:
Visual studio code prior to version 1.62.1
QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of Visual Studio Code.
- Consequence
-
Visual Studio Code is prone to Elevation of Privilege Vulnerability.
- Solution
-
Customers are advised to refer to CVE-2021-42322 for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2021-42322
-
Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability - November 2021
- Severity
- Critical 4
- Qualys ID
- 50116
- Vendor Reference
- KB5007409
- CVE Reference
- CVE-2021-42321
- CVSS Scores
- Base 6.5 / Temporal 5.4
- Description
-
Microsoft Exchange Server Remote Code Execution Vulnerability
KB Articles associated with this update are: KB5007409Affected Versions:
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 10
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2016 Cumulative Update 21
Microsoft Exchange Server 2016 Cumulative Update 22QID Detection Logic (authenticated):
The QID checks for the version of file Exsetup.exe.
- Consequence
-
Successful exploitation allows attackers to execute remote code.
- Solution
-
Customers are advised to refer to KB5007409 for information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5007409
-
Microsoft Exchange Server Spoofing Vulnerability - November 2021
- Severity
- Critical 4
- Qualys ID
- 50117
- Vendor Reference
- KB5007409
- CVE Reference
- CVE-2021-41349, CVE-2021-42305
- CVSS Scores
- Base 4.3 / Temporal 3.6
- Description
-
Microsoft Exchange Server Spoofing Vulnerability
KB Articles associated with this update are: KB5007409Affected Versions:
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 10
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2016 Cumulative Update 21
Microsoft Exchange Server 2016 Cumulative Update 22QID Detection Logic (authenticated):
The QID checks for the version of file Exsetup.exe.
- Consequence
-
Successful exploitation allows attackers to perform Server Spoofing on Victim machine
- Solution
-
Customers are advised to refer to KB5007409 for information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5007409
-
Microsoft Visual Studio Security Update - November 2021
- Severity
- Critical 4
- Qualys ID
- 91831
- Vendor Reference
- CVE-2021-3711, CVE-2021-42277, CVE-2021-42319
- CVE Reference
- CVE-2021-3711, CVE-2021-42277, CVE-2021-42319
- CVSS Scores
- Base 7.5 / Temporal 5.5
- Description
-
Microsoft has released a security Update for Visual Studio which resolves Elevation of privilege and Remote Code Execution Vulnerabilities.
Affected Software:
Microsoft Visual Studio 2019 version 16.11 (includes 16.0-16.10)
Microsoft Visual Studio 2019 version 16.9 (includes 16.0-16.8)
Microsoft Visual Studio 2019 version 16.7 (includes 16.0-16.6)
Microsoft Visual Studio 2017 version 15.9 (includes 15.0-15.8)
and Microsoft Visual Studio 2015 Update 3 - Consequence
-
The vulnerable versions of Visual Studio let attackers to perform Elevation of privilege and Remote Code Execution Attacks.
- Solution
-
Customers are advised to refer to CVE-2021-42319, CVE-2021-42277 and, CVE-2021-3711 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2021-3711
CVE-2021-42277
CVE-2021-42319
KB5007275
-
Microsoft Windows Security Update for November 2021
- Severity
- Critical 4
- Qualys ID
- 91832
- Vendor Reference
- KB5007186, KB5007189, KB5007192, KB5007205, KB5007206, KB5007207, KB5007215, KB5007233, KB5007236, KB5007245, KB5007246, KB5007247, KB5007255, KB5007260, KB5007263
- CVE Reference
- CVE-2021-26443, CVE-2021-36957, CVE-2021-38631, CVE-2021-38665, CVE-2021-38666, CVE-2021-41356, CVE-2021-41366, CVE-2021-41367, CVE-2021-41370, CVE-2021-41371, CVE-2021-41377, CVE-2021-41378, CVE-2021-41379, CVE-2021-42274, CVE-2021-42275, CVE-2021-42276, CVE-2021-42277, CVE-2021-42279, CVE-2021-42280, CVE-2021-42283, CVE-2021-42284, CVE-2021-42285, CVE-2021-42286, CVE-2021-42288
- CVSS Scores
- Base 7.7 / Temporal 6.4
- Description
-
Microsoft releases the security update for Windows November 2021
The KB Articles associated with the update:
KB5007192
KB5007207
KB5007206
KB5007186
KB5007189
KB5007205
KB5007215
KB5007247
KB5007255
KB5007260
KB5007245
KB5007236
KB5007233
KB5007263
KB5007246
This QID checks for the file version of ntoskrnl.exe
The following versions of ntoskrnl.exe with their corresponding KBs are verified:
KB5007192 -10.0.14393.4770
KB5007207- 10.0.10240.19119
KB5007206-10.0.17763.2300
KB5007186-10.0.19041.1348
KB5007189-10.0.18362.1916
KB5007205-10.0.20348.350
KB5007215-10.0.22000.318
KB5007247-6.3.9600.20173
KB5007255-6.3.9600.20173
KB5007260-6.2.9200.23516
KB5007245-6.2.9200.23516
KB5007236-6.1.7601.25767
KB5007233-6.1.7601.25767
KB5007263-6.0.6003.21280
KB5007246-6.0.6003.21280
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the KB5007192
KB5007207
KB5007206
KB5007186
KB5007189
KB5007205
KB5007215
KB5007247
KB5007255
KB5007260
KB5007245
KB5007236
KB5007233
KB5007263
KB5007246
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5007186
KB5007189
KB5007192
KB5007205
KB5007206
KB5007207
KB5007215
KB5007233
KB5007236
KB5007245
KB5007246
KB5007247
KB5007255
KB5007260
KB5007263
-
Microsoft Dynamics 365 Security Update - November 2021
- Severity
- Serious 3
- Qualys ID
- 91833
- Vendor Reference
- CVE-2021-42316
- CVE Reference
- CVE-2021-42316
- CVSS Scores
- Base 6.5 / Temporal 4.8
- Description
-
Microsoft Dynamics 365 is a product line of enterprise resource planning and customer relationship management intelligent business applications.
CVE-2021-42316:Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability
Affected Software:
Microsoft Dynamics 365(on-premise) version 9.0
Microsoft Dynamics 365(on-premise) version 9.1QID Detection Logic(Authenticated):
This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file Microsoft.Crm.Setup.Server.exe:
- Consequence
- Successful exploitation of this vulnerability can result into remote code execution.
- Solution
-
Customers are advised to refer to CVE-2021-42316 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2021-42316
-
Microsoft 3D Viewer Remote Code Execution (RCE) Vulnerability - November 2021
- Severity
- Critical 4
- Qualys ID
- 91834
- Vendor Reference
- CVE-2021-43208, CVE-2021-43209
- CVE Reference
- CVE-2021-43208, CVE-2021-43209
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Microsoft 3D Viewer is prone to Remote Code Execution Vulnerability.
Affected Versions:
Microsoft 3D-Viewer App package versions prior to 7.2107.7012.0QID Detection Logic (Authenticated):
The detection gets the version of Microsoft.Microsoft3DViewer by querying wmi class Win32_InstalledStoreProgram. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Users are advised to check CVE-2021-43208 and CVE-2021-43209 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2021-43208
CVE-2021-43209
-
Microsoft Active Directory Domain Services (AD DS) Elevation of Privilege Vulnerability - November 2021
- Severity
- Critical 4
- Qualys ID
- 91835
- Vendor Reference
- KB5007186, KB5007192, KB5007205, KB5007206, KB5007233, KB5007236, KB5007245, KB5007246, KB5007247, KB5007255, KB5007260, KB5007263
- CVE Reference
- CVE-2021-42278, CVE-2021-42282, CVE-2021-42287, CVE-2021-42291
- CVSS Scores
- Base 6.5 / Temporal 5.4
- Description
-
Microsoft releases the security update for Windows November 2021
The KB Articles associated with the update:
KB5007192
KB5007206
KB5007186
KB5007205
KB5007247
KB5007255
KB5007260
KB5007245
KB5007236
KB5007233
KB5007263
KB5007246
This QID checks for the file version of ntoskrnl.exe
The following versions of ntoskrnl.exe with their corresponding KBs are verified:
KB5007192 -10.0.14393.4770
KB5007206-10.0.17763.2300
KB5007186-10.0.19041.1348
KB5007205-10.0.20348.350
KB5007247-6.3.9600.20173
KB5007255-6.3.9600.20173
KB5007260-6.2.9200.23516
KB5007245-6.2.9200.23516
KB5007236-6.1.7601.25767
KB5007233-6.1.7601.25767
KB5007263-6.0.6003.21280
KB5007246-6.0.6003.21280
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the KB5007192
KB5007206
KB5007186
KB5007205
KB5007247
KB5007255
KB5007260
KB5007245
KB5007236
KB5007233
KB5007263
KB5007246
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5007186
KB5007192
KB5007205
KB5007206
KB5007233
KB5007236
KB5007245
KB5007246
KB5007247
KB5007255
KB5007260
KB5007263
-
Microsoft Windows Defender Remote Code Execution (RCE) Vulnerability - November 2021
- Severity
- Critical 4
- Qualys ID
- 91836
- Vendor Reference
- CVE-2021-42298
- CVE Reference
- CVE-2021-42298
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Microsoft Defender is prone to Remote Code Execution (RCE) Vulnerability.
Affected Software:
Windows DefenderQID Detection Logic (Authenticated):
Detection checks for mpengine.dll file version less than 1.1.18700.3
- Consequence
-
Successful exploitation allows attacker to compromise the system.
- Solution
-
Users are advised to check CVE-2021-42298 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2021-42298
-
Microsoft Power BI Report Server Spoofing Vulnerability - November 2021
- Severity
- Serious 3
- Qualys ID
- 91837
- Vendor Reference
- CVE-2021-41372
- CVE Reference
- CVE-2021-41372
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim.
Affected Versions:
Power BI Report Server (September 2021)
QID Detection Logic:
This authenticated QID detects vulnerable versions of RSHostingService.exe by fetching the service installed path from the HKLM\SYSTEM\CurrentControlSet\Services\PowerBIReportServer registry key. - Consequence
-
Successful exploitation allows an attacker to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded.
- Solution
-
Customers are advised to refer to CVE-2021-41372 for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2021-41372
These new vulnerability checks are included in Qualys vulnerability signature 2.5.326-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110394
- 110395
- 376026
- 50116
- 50117
- 91831
- 91832
- 91833
- 91834
- 91835
- 91836
- 91837
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.