Microsoft patches spoofing vulnerability exploited by Emotet (CVE-2021-43890)

Share on linkedin
Share on facebook
Share on twitter

It’s the final Patch Tuesday of 2021 and Microsoft has delivered fixes for 67 vulnerabilities, including a spoofing vulnerability actively exploited to deliver Emotet/Trickbot/Bazaloader malware family.

Of the 67 CVE-numbered flaws, CVE-2021-43890 – a Windows AppX Installer spoofing vulnerability – will, understandably, be a patching priority.

“CVE-2021-43890 allows an attacker to create a malicious package file and then modify it to look like a legitimate application, and has been used to deliver Emotet malware, which made a comeback this year. The patch should mean that packages can no longer be spoofed to appear as valid, but it will not stop attackers from sending links or attachments to these files,” noted Kevin Breen, Director of Cyber Threat Research, Immersive Labs.

He also considers CVE-2021-43905, an unauthenticated RCE vulnerability in the Microsoft Office app, important to patch quickly, as it has a high CVSS score of 9.6 and Microsoft considers its exploitation to be “More likely”.

Then we have CVE-2021-43883, an elevation of privilege vulnerability in Windows Installer.

“CVE-2021-43883 affects both server and desktop versions of Windows and allows a local user to escalate their privileges, and this kind of vulnerability is highly sought after by attackers looking to move laterally across a network. After gaining the initial foothold, achieving administrator-level access can allow attackers to disable security tools and deploy additional malware or tools like Mimikatz. Almost all ransomware attacks in the last year employed some form of privilege escalation as a key component of the attack prior to launching ransomware,” Breen added.

Stay on Top of Cyber Threats!

Subscribe to our monthly bulletin to stay updated on major cybersecurity risks.

Follow us on Socials:

Recent Cybersecurity News

483 Crypto.com accounts compromised in $34 million hack

Crypto.com has confirmed that a multi-million dollar cyber attack led to the compromise...
Read The Article

CISA urges US orgs to prepare for data-wiping cyberattacks

The Cybersecurity and Infrastructure Security Agency urges U.S. organizations to strengthen their cybersecurity...
Read The Article

Cybercriminals Actively Target VMware vSphere with Cryptominers

Organizations running sophisticated virtual networks with VMware's vSphere service are actively being targeted...
Read The Article

Contact a Specialist

Discover why 1,000+ organizations trust our expertise to improve their cybersecurity.

Stay Updated on Cyber Risks!

Subscribe to the Vumetric Monthly Bulletin to keep up with breaking news in the cybersecurity industry.