Security News > 2021 > March > Microsoft Issues Security Patches for 89 Flaws — IE 0-Day Under Active Attacks
Microsoft plugged as many as 89 security flaws as part of its monthly Patch Tuesday updates released today, including fixes for an actively exploited zero-day in Internet Explorer that could permit an attacker to run arbitrary code on target machines.
Among those five security issues are a clutch of vulnerabilities known as ProxyLogon that allows adversaries to break into Microsoft Exchange Servers in target environments and subsequently allow the installation of unauthorized web-based backdoors to facilitate long-term access.
In the wake of Exchange servers coming under indiscriminate assault toward the end of February by multiple threat groups looking to exploit the vulnerabilities and plant backdoors on corporate networks, Microsoft took the unusual step of releasing out-of-band fixes a week earlier than planned.
The ramping up of mass exploitation after Microsoft released its updates on March 2 has led the company to deploy another series of security updates targeting older and unsupported cumulative updates that are vulnerable to ProxyLogon attacks.
Aside from these actively exploited vulnerabilities, the update also corrects a number of remote code execution flaws in Windows DNS Server, Hyper-V server, SharePoint Server, and Azure Sphere.
To install the latest security updates, Windows users can head to Start > Settings > Update & Security > Windows Update, or by selecting Check for Windows updates.
News URL
Related news
- Update your OpenWrt router! Security issue made supply chain attack possible (source)
- CERT-UA Warns of Phishing Attacks Targeting Ukraine’s Defense and Security Force (source)
- Microsoft enforces defenses preventing NTLM relay attacks (source)
- Week in review: Microsoft fixes exploited 0-day, top cybersecurity books for your holiday gift list (source)
- Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks (source)
- Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them (source)
- Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API (source)
- Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (source)
- Microsoft fixes under-attack privilege-escalation holes in Hyper-V (source)
- 3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update (source)