Log4Shell flaw looms over December Patch Tuesday

Windows zero-day headlines December Patch Tuesday security fixes

Microsoft addressed the Windows AppX Installer zero-day (CVE-2021-43890) to prevent attacks based on the BazaLoader/Emotet/Trickbot malware family. This flaw, rated important, was one of six publicly disclosed vulnerabilities.

Because this vulnerability requires user interaction, a threat actor would have to convince the recipient to open a specially crafted package, such as an email attachment, to trigger the exploit. Administrators may want to go further with Microsoft's guidance and tighten security on user machines through a group policy object that blocks user installs or only allows trusted apps to install. Goettl recommends these steps because updates from the Microsoft Store can be problematic.

"The Microsoft Store apps are supposed to update themselves, but that doesn't always work consistently. Also, detection of the update can be a challenge because there is no consolidated way to visually see all the apps from the store are up to date," he said.

Researcher publicizes Windows Installer vulnerability

Microsoft released a security update on November Patch Tuesday to correct a Windows Installer elevation-of-privilege vulnerability (CVE-2021-41379) rated important for Windows desktop and server systems. But a security researcher said the patch did not completely remedy the flaw and, while conducting a deeper look at the patch, he uncovered a variant of the Windows Installer bug.

Abdelhamid Naceri released proof-of-concept code called InstallerFileTakeOver that takes advantage of a flaw in all Windows systems, including the newest OSes Windows 11 and Windows Server 2022, that bypasses group policy settings to block standard users from access to the administrative install function.  December Patch Tuesday resolves a Windows Installer elevation-of-privilege vulnerability (CVE-2021-43883) which appears to be Naceri's variant, although he is not credited in the CVE notes.  Microsoft acknowledged Naceri this month for his work to develop security updates for a Windows Remote Access elevation-of-privilege vulnerability (CVE-2021-43238) and a Windows Setup elevation-of-privilege vulnerability (CVE-2021-43237).

Other security updates of note from December Patch Tuesday

A Microsoft Office app remote-code execution vulnerability (CVE-2021-43905) rated critical has a CVSS score of 9.6. Microsoft's CVE FAQ indicated the preview pane is not an attack vector -- user interaction is required -- and the Microsoft Store should issue the correction automatically.

A Visual Studio Code Windows Subsystem for Linux Extension remote-code execution vulnerability (CVE-2021-43907) rated critical has a CVSS score of 9.8. Administrators should roll out Version 0.63.11 of the Remote-WSL extension to prevent an exploit.

An Internet Storage Name Service (iSNS) Server memory corruption/remote-code execution vulnerability (CVE-2021-43215) rated critical with a CVSS score of 9.8 affects supported Windows systems, except for Windows 11 and Windows Server 2022. The threat actor on the network could send a specially crafted request to the iSNS Server, which are typically used to help iSCSI devices on a storage area network find each other.