Microsoft Issues Windows Update to Patch 0-Day Used to Spread Emotet Malware

Microsoft has rolled out Patch Tuesday updates^[1]
to address multiple security vulnerabilities in Windows and other
software, including one actively exploited flaw that’s being abused
to deliver Emotet, TrickBot, or Bazaloader malware payloads.

The latest monthly release for December fixes a total of 67
flaws, bringing the total number of bugs patched by the company
this year to 887, according to the Zero Day Initiative^[2]. Seven of the 67 flaws
are rated Critical and 60 are rated as Important in severity, with
five of the issues publicly known at the time of release. It’s
worth noting that this is in addition to the 21 flaws^[3]
resolved in the Chromium-based Microsoft Edge browser.

The most critical of the lot is CVE-2021-43890^[4]
(CVSS score: 7.1), a Windows AppX installer spoofing vulnerability
that Microsoft said could be exploited to achieve arbitrary code
execution. The lower severity rating is indicative of the fact that
code execution hinges on the logged-on user level, meaning “users
whose accounts are configured to have fewer user rights on the
system could be less impacted than users who operate with
administrative user rights.”

The Redmond-based tech giant noted that an adversary could
leverage the flaw by crafting a malicious attachment that’s then
used as part of a phishing campaign to trick the recipients into
opening the email attachment. Sophos security researchers Andrew
Brandt as well as Rick Cole and Nick Carr of the Microsoft Threat
Intelligence Center (MSTIC), have been credited with reporting the
vulnerability.

“Microsoft is aware of attacks that attempt to exploit this
vulnerability by using specially crafted packages that include the
malware family known as Emotet/ Trickbot/ Bazaloader,” the company
further added. The development comes as Emotet malware campaigns
are witnessing a surge in activity^[5] after more than a
10-month-long hiatus following a coordinated law enforcement effort
to disrupt the botnet’s reach.

Other flaws that are publicly known are below —

• CVE-2021-43240^[6] (CVSS score: 7.8) – NTFS
  Set Short Name Elevation of Privilege Vulnerability
• CVE-2021-43883^[7] (CVSS score: 7.8) –
  Windows Installer Elevation of Privilege Vulnerability
• CVE-2021-41333^[8] (CVSS score: 7.8) –
  Windows Print Spooler Elevation of Privilege Vulnerability
• CVE-2021-43893^[9] (CVSS score: 7.5) –
  Windows Encrypting File System (EFS) Elevation of Privilege
  Vulnerability
• CVE-2021-43880^[10] (CVSS score: 5.5) –
  Windows Mobile Device Management Elevation of Privilege
  Vulnerability

The December patch also comes with remediations for 10 remote
code execution flaws in Defender for IoT, in addition to critical
bugs affecting iSNS Server (CVE-2021-43215^[11]), 4K Wireless Display
Adapter (CVE-2021-43899^[12]), Visual Studio Code
WSL Extension (CVE-2021-43907^[13]), Office app (CVE-2021-43905^[14]), Windows Encrypting
File System (CVE-2021-43217^[15]), Remote Desktop Client
(CVE-2021-43233^[16]), and SharePoint Server
(CVE-2021-42309^[17]).

Software Patches From Other Vendors

Besides Microsoft, security updates have also been released by
other vendors to rectify several vulnerabilities, including —

Furthermore, numerous security advisories^[18] have been released by
dozens of companies for the actively exploited Log4j remote code execution
vulnerability^[19] that could allow the
complete takeover of affected systems.