Microsoft March 2021 Patch Tuesday fixes 82 flaws, 2 zero-days

Today is Microsoft's March 2021 Patch Tuesday, and with admins already struggling with Microsoft Exchange updates and hacked servers, please be nice to your IT staff today.

With today's update, Microsoft has fixed 82 vulnerabilities, with 10 classified as Critical and 72 as Important. These numbers do not include the 7 Microsoft Exchange and 33 Chromium Edge vulnerabilities released earlier this month.

There are also two zero-day vulnerabilities patched today that were publicly disclosed and known to be used in attacks.

For information about the non-security Windows updates, you can read about today's Windows 10 KB5000808 & KB5000802 cumulative updates.

Microsoft Exchange ProxyLogon attacks

Last week, Microsoft released out-of-band security updates for the ProxyLogon vulnerability that are actively being used by threat actors worldwide to compromise Microsoft Exchange servers.

Threat actors exploit these vulnerabilities on publicly accessible Outlook on the Web (OWA) servers to install web shells and other malware.

These vulnerabilities are being tracked with the following CVEs:

• CVE-2021-26855 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-26857 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-26858 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-27065 - Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft has released security updates for currently supported Microsoft Exchange cumulative updates and older unsupported versions.

While installing the updates will prevent the server from being compromised, attacks have been so pervasive that admins should analyze all Exchange servers for attacks that may have occurred before the patches were installed.

Can't stress this enough: patching is *not* enough.
Check your logs for IOCs. If you're only patching this now, this is most likely going to be ugly. https://t.co/Sahf6KDvlM

— x0rz (@x0rz) March 9, 2021

Microsoft has released a PowerShell script called Test-ProxyLogon.ps1 that will check for indicators of compromise (IOC) in Exchange HttpProxy logs, Exchange log files, and Windows Application event logs.

Microsoft has also updated Microsoft Defender to detect web shells and other IOCs associated with these attacks.

Their standalone Microsoft Safety Scanner (MSERT) tool has been updated to detect web shells and other IOCs for those not using Microsoft Defender.

With the fixes for the zero-days, Microsoft also released fixes for three Microsoft Exchange vulnerabilities not exploited in attacks:

• CVE-2021-26412 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-26854 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-27078 - Microsoft Exchange Server Remote Code Execution Vulnerability

Two other zero-day vulnerabilities were fixed

Microsoft also fixed two other zero-day vulnerabilities today, with one publicly used in attacks.

In January, Google disclosed that the Lazarus group was conducting attacks against security researchers using compromised Visual Studio projects and unknown zero-day exploits. 

In February, South Korean cybersecurity firm Enki disclosed that the threat actors used an Internet Explorer zero-day vulnerability in the attacks to install custom backdoors.

This vulnerability, tracked as "CVE-2021-26411 - Internet Explorer Memory Corruption Vulnerability," is fixed today.

Another zero-day vulnerability fixed today is tracked as "CVE-2021-27077 - Windows Win32k Elevation of Privilege Vulnerability."

This vulnerability was publicly disclosed by Trend Micro Zero Day Initiative in January after Microsoft initially stated that they would not fix it.

Update: We incorrectly stated that the CVE-2021-27077 zero-day was used in attacks. It was just publicly disclosed.

Recent updates from other companies

Other vendors who released updates in March include:

• Adobe released security updates for Adobe Creative Cloud Desktop, Framemaker, and Connect.
• Android's March security updates were released last week.
• Apple released iOS, macOS, watchOS, and Safari updates yesterday.
• Cisco released security updates for numerous products.
• SAP released its March 2021 security updates.
• VMware released security updates for the View Planner tool.

The March 2021 Patch Tuesday Security Updates

Below is the full list of resolved vulnerabilities and released advisories in the March 2021 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects, you can view the full report here.