Microsoft Windows February 2021 Patch Tuesday Fixes 56 Bugs

Microsoft has released today its monthly batch of security updates, known as Patch Tuesday. This month, the OS maker has fixed 56 security vulnerabilities, including a Windows bug that was being exploited in the wild before today's patches.

Tracked as CVE-2021-1732, the Windows zero-day is an elevation of privilege's bug in Win32k, a core component of the Windows operating system.

A total of six Microsoft product bugs had their details posted online before today's patches. This included:

• CVE-2021-1721 - .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2021-1733 - Sysinternals PsExec Elevation of Privilege Vulnerability
• CVE-2021-26701 - .NET Core Remote Code Execution Vulnerability
• CVE-2021-1727 - Windows Installer Elevation of Privilege Vulnerability
• CVE-2021-24098 - Windows Console Driver Denial of Service Vulnerability
• CVE-2021-24106 - Windows DirectX Information Disclosure Vulnerability

CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086 are two RCEs and one DoS vulnerability in Windows’ TCP/IP implementation that have been singled out by Microsoft for a quick patch (or mitigation implementation).

One “important” flaw (CVE-2021-1732) is being actively exploited in the wild: a local privilege escalation flaw that affects various versions of Windows 10 and Windows Server. This one is exploitable by attackers who have local physical access to the target machine, can access it remotely (e.g., via SSH), or can simply trick the legitimate user into opening a malicious document.

The good news is that none of these bugs were exploited by attackers, despite their details being posted online.

Detailed list of Microsoft Patch February 2021

Microsoft Security Response Center