Four zero-days vulnerabilities and 71 flaws fixed via this month's Patch Tuesday

Today is Microsoft’s October 2021 Patch Tuesday, and with it comes fixes for four zero-day vulnerabilities and a total of 74 flaws.

Microsoft has fixed 74 vulnerabilities (81 including Microsoft Edge) with today’s update, with three classified as Critical, and 70 as Important, and one as Low.

4 zero-days vulnerabilities fixed, with one actively exploited

These 81 vulnerabilities that are being patched during this month’s rollout are split into categories, as follows:

• 21 Elevation of Privilege Vulnerabilities
• 6 Security Feature Bypass Vulnerabilities
• 20 Remote Code Execution Vulnerabilities
• 13 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 9 Spoofing Vulnerabilities

October’s Patch Tuesday includes fixes for four zero-day vulnerabilities, with a Win32k Elevation of Privilege Vulnerability vulnerability known to have been actively exploited in attacks.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited vulnerability was discovered by Kaspersky’s Boris Larin (oct0xor) and allows malware or a threat actor to gain elevated privileges on a Windows device.

• CVE-2021-40449 – Win32k Elevation of Privilege Vulnerability

Kaspersky disclosed that the vulnerability was used by threat actors in “widespread espionage campaigns against IT companies, military/defense contractors, and diplomatic entities.” 

As part of the attacks, the threat actors installed a remote access trojan (RAT) that was elevated with higher permissions using the zero-day Windows vulnerability. 

Thus, Kaspersky calls this cluster of malicious activity MysterSnail and is attributed to the IronHusky and Chinese-speaking APT activity.

Microsoft also fixed three other publicly disclosed vulnerabilities that are not known to be exploited in attacks.

• CVE-2021-40469 – Windows DNS Server Remote Code Execution Vulnerability
• CVE-2021-41335 – Windows Kernel Elevation of Privilege Vulnerability
• CVE-2021-41338 – Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability

Other companies also released important updates

• Adobe’s October security updates were released for various applications.
• Android’s October security updates were released last week.
• Apache released HTTP Web Server 2.4.51 to fix an incompete patch for an actively exploited vulnerability.
• Apple released security updates for iOS and iPadOS yesterday that an actively exploited zero-day vulnerability.
• Cisco released security updates for numerous products this month.
• SAP released its October 2021 security updates.
• VMware released a security update for VMware vRealize Operations.

This month’s security updates

Below is the complete list of resolved vulnerabilities and released advisories in the October 2021 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects, you can view the full report here.

Have you been struggling with any of the errors and bugs listed in this article? Let us know in the comments section below.