Microsoft February 2021 Patch Tuesday fixes 56 flaws, 1 zero-day

Today is Microsoft's February 2021 Patch Tuesday, so please be buy your Windows administrators some snacks to keep their energy up throughout the day.

With today's update, Microsoft has fixed for 56 vulnerabilities, with eleven classified as Critical, two as Moderate, and 43 as Important. 

There is also one zero-day vulnerability and six previously disclosed vulnerabilities fixed as part of the February 2021 updates.

For information about the non-security Windows updates, you can read about today's Windows 10 KB4601315 & KB4601319 cumulative updates.

Zero-day and publicly disclosed vulnerabilities fixed

Microsoft fixed both a zero-day and numerous publicly disclosed vulnerabilities as part of the months security updates.

The actively exploited zero-day is tracked as 'CVE-2021-1732 - Windows Win32k Elevation of Privilege Vulnerability' and allows an attacker or malicious program to elevate their privileges to administrative privileges.

This vulnerability was discovered by researchers at DBAPPSecurity Co., Ltd.

In addition to the zero-day vulnerability, Microsoft also states that they also patched numerous publicly disclosed vulnerabilities:

• CVE-2021-1721 - .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2021-1727 - Windows Installer Elevation of Privilege Vulnerability
• CVE-2021-1733 - Sysinternals PsExec Elevation of Privilege Vulnerability
• CVE-2021-24098 - Windows Console Driver Denial of Service Vulnerability
• CVE-2021-24106 - Windows DirectX Information Disclosure Vulnerability
• CVE-2021-26701 - .NET Core Remote Code Execution Vulnerability

Supply chain attack fix

Today, Microsoft fixed a vulnerability tracked as CVE-2021-24105 in their Azure Artifactory product that was discovered after researchers used it in a PoC attack against Microsoft's systems.

This vulnerability allowed threat actors to create malicious public packages that have the same name as internal packages used by internal company applications. When these applications are built, they would instead pull down the malicious package rather than using their own internal one, and trigger a supply chain attack.

This attack affected numerous companies including Microsoft, Apple, PayPal, Shopify, Netflix, Tesla, Yelp, Tesla, and Uber.

More information about this vulnerability can be found in our dedicated 'Researcher hacks Microsoft, Apple, more in novel supply chain attack' article.

Recent updates from other companies

Other vendors who released updates in February include:

• Adobe released numerous fixes for Adobe Acrobat and Reader.
• Android's February security updates were released last week.
• Apple released macOS and Safari updates at the beginning of the month.
• Cisco released security updates for the Cisco iOS, Cisco Security Manager, Identity Manager, and for an RCE vulnerability in their SMB VPN routers.
• Fortinet released security fixes for FortiProxy SSL VPN and FortiWeb.
• SAP released its February 2021 security updates.
• SonicWall released a fix for their SMA-100 zero day vulnerability.

The February 2021 Patch Tuesday Security Updates

Below is the full list of resolved vulnerabilities and released advisories in the February 2021 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects, you can view the full report here.