Service Notices

All Notices > Security Notices > February 2021 Security Updates

February 2021 Security Updates

Feb 25, 2021 GMT+08:00

I. Overview

Microsoft recently released its monthly set of security updates. 56 vulnerabilities are disclosed, among which 11 are rated important. Attackers can exploit these vulnerabilities to perform remote code execution, escalate privileges, and leak sensitive information. The following software is affected: Microsoft Windows, Office, and .NET Core.

For more information, visit Microsoft official website:

https://msrc.microsoft.com/update-guide/releaseNote/2021-Feb

Among these vulnerabilities, the following are critical. Check your system and install the patch to prevent attacks:

CVE-2021-24074: a Windows TCP/IP remote code execution vulnerability. Malicious attackers can exploit this vulnerability to construct specially crafted data packets to trigger the execution of arbitrary code on the remote host.

CVE-2021-24078: a Windows DNS server remote code execution vulnerability. This vulnerability affects servers that have DNS configurations.

CVE-2021-1727: a Windows Installer elevation of privilege vulnerability. This vulnerability is highly risky. Microsoft is aware of this vulnerability and attacks exploiting this vulnerability. Details about this vulnerability and POC has been disclosed on the Internet.

Other high-risk privilege escalation vulnerabilities include: CVE-2020-1472, a Netlogon elevation of privilege vulnerability, CVE-2021-1732, a Windows Win32k elevation of privilege vulnerability, and CVE-2021-1733, a Sysinternals PsExec elevation of privilege vulnerability.

II. Severity

Severity: important

(Severity: low, moderate, important, and critical)

III. Affected Products

Microsoft Windows, Office, and .NET Core.

IV. Vulnerability Details

CVE ID

Vulnerability Name

Severity

Affected Product

CVE-2021-24074

CVE-2021-24094

Windows TCP/IP Remote Code Execution Vulnerability

Important

Windows 10/7/8.1/RT8.1, Windows Server   2008/2008R2/2012/2012 R2/2016/2019

CVE-2021-24078

Windows DNS Server Remote Code Execution Vulnerability

Important

Windows Server   2008/2008R2/2012/2012 R2/2016/2019

CVE-2021-24112

CVE-2021-26701

.NET Framework Remote Code Execution Vulnerability

Important

.NET 5.0, .NET Core 2.1/3.1

CVE-2021-24081

Microsoft Windows Codecs Library Remote Code Execution Vulnerability

Important

Windows 10, Windows Server 2016/2019

CVE-2021-24088

Windows Local Spooler Remote Code Execution Vulnerability

Important

Windows 10/7/8.1/RT8.1, Windows Server   2008/2008R2/2012/2012 R2/2016/2019

CVE-2021-24093

Microsoft Graphics Components Remote Code Execution Vulnerability

Important

Windows 10, Windows Server 2016/2019

CVE-2021-24091

Windows Camera Codec Pack Remote Code Execution Vulnerability

Important

Windows 10, Windows Server 2016/2019

CVE-2021-1722

CVE-2021-24077

Windows Fax Service Remote Code Execution Vulnerability

Important

Windows 10/7/8.1/RT8.1, Windows Server 2008/2008R2/2012/2012   R2/2016/2019

(Note: Vulnerabilities listed above are important ones. For more information, refer to the official website of Microsoft.)

V. Security Recommendations

1. Use Windows Update or download patches from the following address to fix the vulnerabilities:

https://msrc.microsoft.com/update-guide/

2. Back up data remotely to protect your data.

Note: Before fixing vulnerabilities, back up your files and conduct a thorough test.