09/09/2021

Microsoft vulnerability - Remote Code Execution (CVE-2021-40444) 

update from our previous post – Active exploitation of Microsoft vulnerability

Summary 

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. 

User interaction is required to exploit this vulnerability, users must first open malicious documents. Microsoft Office handles documents received over the Internet in Protected View or through Application Guard for Office, either can prevent CVE-2021-40444 from being exploited. However, users may click the Enable Editing button, thus disarming Microsoft’s security mechanisms. 

Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability, shown as: “Suspicious Cpl File Execution”. Customers who utilise automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments ASAP. 

Jisc are not able to carry out Janet wide scans for this vulnerability as it is client based. 

Vulnerable versions: 

  • Microsoft Windows 10 (1607 through 21H1) 
  • Microsoft Windows 8.1 
  • Microsoft Windows 7 
  • Windows Server (2008 R2 through 2022) 
  • Windows Server (2004 and 20H2) 

Recommendation(s): 

  • Ensure a modern anti-malware solution is deployed to all client devices. 
  • Ensure anti-malware policies are applied consistently across all client devices. 
  • Ensure anti-malware solutions (Engines and Definitions) are kept up to date in line with vendor release cycles. 
  • Ensure a security solution is in place at the corporate mail gateway level, preferably one with sandbox capabilities. 
  • Raise user awareness with regards to modern cyberthreats, reminding to never open documents from untrusted sources 
  • Consider disabling ActiveX downloads using the workaround provided by the Microsoft Security Response Center (MSRC) at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 
  • Monitor the above MSRC page for updates from Microsoft on this evolving issue 

Full details and references 

Keeping Up To Date With Us Is Easy, Sign Up To Our Newsletter Today!

Stay in touch with emPSN, so that you get the latest e-safety advice and invites to our community events.

    Our partners