Microsoft August 2021 Patch Tuesday fixes 3 zero-days, 44 flaws

Today is Microsoft’s August 2021 patch Tuesday, and with it, fixes for three zero-day vulnerabilities and a total of 44 flaws, so be nice to your Windows admins as they rush around to the patches installed.

Microsoft fixed 44 vulnerabilities (51 including Microsoft Edge) with today’s update, including seven classified as critical and 37 as important.

Of the 44 vulnerabilities, 13 are remote code execution, eight are information disclosure, two are denial of service, and four are spoofing vulnerabilities.

For more information on non-security Windows updates, you can read today’s Windows 10 cumulative updates KB5005033 and KB5005031.

Microsoft corrects PrintNightmare and PetitPotam attacks

Microsoft has released security updates for two highly anticipated zero-day vulnerabilities that were discovered over the past month.

One of the security updates addresses vulnerabilities in PrintNightmare that allow malicious actors to gain SYSTEM-level privileges simply by connecting to a remote print server under their control.

Microsoft corrected this vulnerability by requiring users to have administrative privileges to install printer drivers using the Windows Point and Print feature.

You can find more detailed information about the PrintNightmare vulnerability and Point and Print mitigations in a dedicated article published today.

Microsoft also fixed the PetitPotam NTLM relay attack vector which uses the MS-EFSRPC API to force a device to negotiate with a remote relay server under the control of an attacker.

A threat actor with low privileges could use this attack to take control of a domain controller and therefore of the entire Windows domain.

Three fixed zero-days, one of which is actively exploited

The August Patch Tuesday includes three zero-day vulnerabilities, one of which is actively exploited in the wild.

Microsoft classifies a vulnerability as a zero day if it is publicly disclosed or actively exploited without an official or released security update.

The two publicly disclosed, but not actively exploited zero-day vulnerabilities are:

The CVE-2021-36942 vulnerability is associated with the PetitPotam NTLM relay attack vector, which allows domain controllers to be taken over.

Finally, an actively exploited elevation of privilege vulnerability has been discovered by the Microsoft Security Response Center (MSRC) and the Microsoft Threat Intelligence Center (MSTIC).

• CVE-2021-36948 – Windows Update Medic Service Elevation of Privilege Vulnerability

It is not known how threat actors have used this vulnerability in attacks at this time.

Recent updates from other companies

Other vendors who released updates in July include:

August 2021 Patch Tuesday security updates

Below is the full list of fixed vulnerabilities and notices published in the August 2021 Patch Tuesday updates. For a full description of each vulnerability and the systems it affects, you can view the report. full here.