Coming Soon...

Q-CERT website is currently under maintenance. We should be back shortly. Thank you for yor patience.

Microsoft September 2021 Patch Tuesday

Issued: 
Wednesday, 29 September, 2021
Last Revision: 
Wednesday, 29 September, 2021
Vendor: 
Microsoft
Product: 
Multiple products
Severity Level: 
High
Summary: 

Microsoft has released patches for 60 vulnerabilities (86 including Microsoft Edge), with 3 classified as Critical and 56 as Important, including 2 Zero-days with one actively exploited in the wild.

 

Some notable vulnerabilities resolved in this update are:

CVE-2021-40444- Microsoft MSHTML Remote Code Execution Vulnerability

CVE-2021-36968- Windows DNS Elevation of Privilege Vulnerability

Multiple CVEs     - Windows Print Spooler Vulnerabilities

 

 

In September 2021 Microsoft has fixed problems of Elevation of Privilege Vulnerabilities, Security Feature Bypass Vulnerabilities, Remote Code Execution Vulnerabilities, Information Disclosure Vulnerabilities, Denial of Service Vulnerabilities and Spoofing Vulnerabilities. 

 

Products patched in September security update include Azure Open Management Infrastructure, Azure Sphere, Office Excel, PowerPoint, Word, and Access; the kernel, Visual Studio, Microsoft Windows DNS, and BitLocker, among other software. 

Organizations are strongly encouraged to apply patches as soon as possible, particularly patches for exploited zero day, Windows Print Spooler and critical vulnerabilities. 

 

 

CVE

Description 

CVSS3.0 Score

CVE-2021-40444

Microsoft MSHTML Remote Code Execution Vulnerability

8.8

CVE-2021-36968

Windows DNS Elevation of Privilege Vulnerability

7.8

CVE-2021-38647

Open Management Infrastructure Remote Code Execution Vulnerability

9.8

CVE-2021-26435

Windows Scripting Engine Memory Corruption Vulnerability

8.1

CVE-2021-36967

Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability

8.0

CVE-2021-36965

Windows WLAN AutoConfig Service Remote Code Execution Vulnerability

8.8

CVE-2021-36958

Windows Print Spooler Remote Code Execution Vulnerability

7.8

CVE-2021-1678

Windows Print Spooler Spoofing Vulnerability

8.8

CVE-2021-38667

Windows Print Spooler Elevation of Privilege Vulnerability

7.8

CVE-2021-38671

Windows Print Spooler Elevation of Privilege Vulnerability

7.8

CVE-2021-40447

Windows Print Spooler Elevation of Privilege Vulnerability

7.8

CVE-2021-36955

Windows Common Log File System Driver Elevation of Privilege Vulnerability

7.8

CVE-2021-36963

Windows Common Log File System Driver Elevation of Privilege Vulnerability

7.8

CVE-2021-38633

Windows Common Log File System Driver Elevation of Privilege Vulnerability

7.8

CVE-2021-36975

Win32k Elevation of Privilege Vulnerability

7.8

CVE-2021-38639

Win32k Elevation of Privilege Vulnerability

7.8

 

 

                                                                                              Table 1: Vulnerability details 

 

 

Vulnerability / CVE

Affected Product(s)

CVE-2021-40444

Windows 7 for x64based Systems Service Pack 1

Windows 7 for 32bit Systems Service Pack 1

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64based Systems

Windows 10 Version 1607 for 32bit Systems

Windows 10 for x64based Systems

Windows 10 for 32bit Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32bit Systems

Windows 10 Version 21H1 for ARM64based Systems

Windows 10 Version 21H1 for x64based Systems

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

 

 

CVE-2021-36968

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows 7 for x64-based Systems Service Pack 1

Windows 7 for 32-bit Systems Service Pack 1

CVE-2021-38647

Azure Open Management Infrastructure

CVE-2021-26435

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows 7 for x64based Systems Service Pack 1

Windows 7 for 32bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64based Systems

Windows 10 Version 1607 for 32bit Systems

Windows 10 for x64based Systems

Windows 10 for 32bit Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32bit Systems

Windows 10 Version 21H1 for ARM64based Systems

Windows 10 Version 21H1 for x64based Systems

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

 

 

CVE-2021-36967

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64based Systems

Windows 10 Version 1607 for 32bit Systems

Windows 10 for x64based Systems

Windows 10 for 32bit Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows 10 Version 21H1 for 32bit Systems

Windows 10 Version 21H1 for ARM64based Systems

Windows 10 Version 21H1 for x64based Systems

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

 

CVE-2021-36965

 

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems
 
Windows 7 for x64based Systems Service Pack 1
 
Windows 7 for 32bit Systems Service Pack 1
 
Windows Server 2016 (Server Core installation)
 
Windows Server 2016
 
Windows 10 Version 1607 for x64based Systems
 
Windows 10 Version 1607 for 32bit Systems
 
Windows 10 for x64based Systems
 
Windows 10 for 32bit Systems
 
Windows Server, version 20H2 (Server Core Installation)
 
Windows 10 Version 20H2 for ARM64based Systems
 
Windows 10 Version 20H2 for 32bit Systems
 
Windows 10 Version 20H2 for x64based Systems
 
Windows Server, version 2004 (Server Core installation)
 
Windows 10 Version 2004 for x64based Systems
 
Windows 10 Version 2004 for ARM64based Systems
 
Windows 10 Version 2004 for 32bit Systems
 
Windows Server 2022 (Server Core installation)
 
Windows Server 2022
 
Windows 10 Version 21H1 for 32bit Systems
 
Windows 10 Version 21H1 for ARM64based Systems
 
Windows 10 Version 21H1 for x64based Systems
 
Windows 10 Version 1909 for ARM64based Systems
 
Windows 10 Version 1909 for x64based Systems
 
Windows 10 Version 1909 for 32bit Systems
 
Windows Server 2019 (Server Core installation)
 
Windows Server 2019
 
Windows 10 Version 1809 for ARM64based Systems
 
Windows 10 Version 1809 for x64based Systems
 
Windows 10 Version 1809 for 32bit Systems

 

 

 

CVE-2021-36958

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows 7 for x64based Systems Service Pack 1

Windows 7 for 32bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016
 
Windows 10 Version 1607 for x64based Systems
 
Windows 10 Version 1607 for 32bit Systems
 
Windows 10 for x64based Systems
 
Windows 10 for 32bit Systems
 
Windows Server, version 20H2 (Server Core Installation)
 
Windows 10 Version 20H2 for ARM64based Systems
 
Windows 10 Version 20H2 for 32bit Systems
 
Windows 10 Version 20H2 for x64based Systems
 
Windows Server, version 2004 (Server Core installation)
 
Windows 10 Version 2004 for x64based Systems
 
Windows 10 Version 2004 for ARM64based Systems
 
Windows 10 Version 2004 for 32bit Systems
 
Windows 10 Version 21H1 for 32bit Systems
 
Windows 10 Version 21H1 for ARM64based Systems
 
Windows 10 Version 21H1 for x64based Systems
 
Windows 10 Version 1909 for ARM64based Systems
 
Windows 10 Version 1909 for x64based Systems
 
Windows 10 Version 1909 for 32bit Systems
 
Windows Server 2019 (Server Core installation)
 
Windows Server 2019
 
Windows 10 Version 1809 for ARM64based Systems
 
Windows 10 Version 1809 for x64based Systems
 
Windows 10 Version 1809 for 32bit Systems

 

 

 

CVE-2021-1678

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows 7 for x64based Systems Service Pack 1

Windows 7 for 32bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64based Systems

Windows 10 Version 1607 for 32bit Systems

Windows 10 for x64based Systems

Windows 10 for 32bit Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows Server, version 1909 (Server Core installation)

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

Windows 10 Version 1803 for ARM64based Systems

Windows 10 Version 1803 for x64based Systems

Windows 10 Version 1803 for 32bit Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

 

 

CVE-2021-38667

CVE-2021-38671

CVE-2021-40447

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows 7 for x64based Systems Service Pack 1

Windows 7 for 32bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64based Systems

Windows 10 Version 1607 for 32bit Systems

Windows 10 for x64based Systems

Windows 10 for 32bit Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32bit Systems

Windows 10 Version 21H1 for ARM64based Systems

Windows 10 Version 21H1 for x64based Systems

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

 

 

 

CVE-2021-36955

CVE-2021-36963

CVE-2021-38633

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows 7 for x64based Systems Service Pack 1

Windows 7 for 32bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64based Systems

Windows 10 Version 1607 for 32bit Systems

Windows 10 for x64based Systems

Windows 10 for 32bit Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32bit Systems

Windows 10 Version 21H1 for ARM64based Systems

Windows 10 Version 21H1 for x64based Systems

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

 

 

 

CVE-2021-36975

 

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32bit Systems

Windows 10 Version 21H1 for ARM64based Systems

Windows 10 Version 21H1 for x64based Systems

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

 

 

CVE-2021-38639

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows 7 for x64based Systems Service Pack 1

Windows 8.1 for 32bit systems
 
Windows 7 for x64based Systems Service Pack 1
 
Windows 7 for 32bit Systems Service Pack 1
 
Windows Server 2016 (Server Core installation)
 
Windows Server 2016
 
Windows 10 Version 1607 for x64based Systems
 
Windows 10 Version 1607 for 32bit Systems
 
Windows 10 for x64based Systems
 
Windows 10 for 32bit Systems
 
Windows Server, version 20H2 (Server Core Installation)
 
Windows 10 Version 20H2 for ARM64based Systems
 
Windows 10 Version 20H2 for 32bit Systems
 
Windows 10 Version 20H2 for x64based Systems
 
Windows Server, version 2004 (Server Core installation)
 
Windows 10 Version 2004 for x64based Systems
 
Windows 10 Version 2004 for ARM64based Systems
 
Windows 10 Version 2004 for 32bit Systems
 
Windows Server 2022 (Server Core installation)
 
Windows Server 2022
 
Windows 10 Version 21H1 for 32bit Systems
 
Windows 10 Version 21H1 for ARM64based Systems
 
Windows 10 Version 21H1 for x64based Systems
 
Windows 10 Version 1909 for ARM64based Systems
 
Windows 10 Version 1909 for x64based Systems
 
Windows 10 Version 1909 for 32bit Systems
 
Windows Server 2019 (Server Core installation)
 
Windows Server 2019
 
Windows 10 Version 1809 for ARM64based Systems
 
Windows 10 Version 1809 for x64based Systems
 
Windows 10 Version 1809 for 32bit Systems

 

                                                                                 Table 2: Vulnerable versions

 

Recommendation: 

Microsoft has released patches to address these vulnerabilities and recommends organizations to mitigate urgently.

 

Refer – 

 

https://msrc.microsoft.com/update-guide/

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36968

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26435

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36967

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36965

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1678

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38667

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38671

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40447

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36955

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36963

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38633

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36975

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38639

 

 

References: 
Security Update Guide