Share this article
Latest news
With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low
Copilot in Outlook will generate personalized themes for you to customize the app
Microsoft will raise the price of its 365 Suite to include AI capabilities
Death Stranding Director’s Cut is now Xbox X|S at a huge discount
Outlook will let users create custom account icons so they can tell their accounts apart easier
44 flaws fixed through the August 2021 Patch Tuesday release
7 min. read
Updated onOctober 4, 2023
updated onOctober 4, 2023
Share this article
Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more
Key notes
As you are well aware by now, every second Tuesday of each month means that we are getting important updates from the Redmond company, as a part of the Patch Tuesday release.
Microsoft provided 44 security fixes for August’s Patch Tuesday, with seven of the vulnerabilities being rated critical. There were also three zero-days included in the batch and the other 37 were rated as important.
Also important is the fact that thirteen of the patches involved a remote code execution vulnerability while another eight revolved around information disclosure.
Three zero days errors fixes via the August 2021 Patch Tuesday
The most important patch released in the latest batch addresses the Windows Print Spooler Remote Code Execution vulnerability, which has been amajor topic of discussionsince it was discovered back in June.
The tech company faced major backlash from the security community for totally messing up the release of patches meant to address the issue.
The affected tools are .NET Core & Visual Studio, ASP.NET Core & Visual Studio, Azure, Windows Update, Windows Print Spooler Components, Windows Media, Windows Defender, Remote Desktop Client, Microsoft Dynamics, Microsoft Edge (Chromium-based), Microsoft Office, Microsoft Office Word, Microsoft Office SharePoint and more.
And since we’ve mentioned that Microsoft also addressed three zero-days vulnerabilities through this update event, here is exactly what they had to deal with:
The Windows Update Medic Service Elevation of Privilege vulnerability is apparently the only one that has been exploited in the wild, according to Microsoft’s report.
One of the security experts, Allan Liska, saidCVE-2021-36948stood out to him because of its similarities toCVE-2020-17070, which was published in November 2020.
Obviously, it is bad that it is being exploited in the wild, but we saw almost the exact same vulnerability in November of 2020 but I can’t find any evidence that that was exploited in the wild. So, I wonder if this is a new focus for threat actors.
Liska later added that CVE-2021-26424 is a major vulnerability because it is a Windows TCP/IP Remote Code Execution vulnerability, that impacts Windows 7 through 10 and Windows Server 2008 through 2019.
While this vulnerability is not listed as publicly disclosed or exploited in the wild, Microsoft did label this as ‘Exploitation More Likely’ meaning that exploitation is relatively trivial. Vulnerabilities in the TCP/IP stack can be tricky. There was a lot of concern earlier this year around CVE-2021-24074, a similar vulnerability, but that has not been exploited in the wild. On the other hand, last year’s CVE-2020-16898, another similar vulnerability, has been exploited in the wild.
Microsoft fixes PrintNightmare and PetitPotam attacks
The LSA spoofing vulnerability is related to an advisory Microsoft sent out late last month about how to protect Windows domain controllers and other Windows servers from the NTLM Relay Attack known as PetitPotam.
The PetitPotam method, which was discovered in July by French researcher Gilles Lionel, takes on the NTLM Relay attack that can coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function.
Adobe alsoreleasedtwo patches addressing 29 CVEs in Adobe Connect and Magento. This is the smallest number of patches released by Microsoft since December 2019.
This decline is mainly due to resource constraints, considering Microsoft devoted extensive time in July responding to events likePrintNightmareandPetitPotam.
Patch Tuesday August 2021 security updates
This is the complete list of resolved vulnerabilities and released advisories in the August 2021 Patch Tuesday updates.
Recent security updates from other companies
Other companies that released updates are as follows:
What is your opinion on the recent plan of action that Microsoft turned to? Share your thoughts with us in the comments section below.
Vlad Turiceanu
Windows Editor
Passionate about technology,Windows, and everything that has a power button, he spent most of his time developing new skills and learning more about the tech world.
Coming from a solid background in PC building and software development, with a complete expertise in touch-based devices, he is constantly keeping an eye out for the latest and greatest!
User forum
0 messages
Sort by:LatestOldestMost Votes
Comment*
Name*
Email*
Commenting as.Not you?
Save information for future comments
Comment
Δ
Vlad Turiceanu
Windows Editor
Coming from a solid background in PC building and software development, he’s a Windows 11 Privacy & Security expert.
