Vulnerability announcement | Multiple critical Windows vulnerabilities (CVE-2021-24074, CVE-2021-24078, and more) -

On February 10, 2021, Microsoft released its monthly security patches to address multiple critical vulnerabilities, including a TCP/IP remote code execution vulnerability (CVE-2021-24074) and a Windows DNS Server remote code execution vulnerability (CVE-2021-24078).

Vulnerability information

Vulnerability IDs: CVE-2021-24074, CVE-2021-24078
Vulnerability severity: Critical
Affected versions:
- Windows Server 2019
- Windows Server 2016
- Windows Server 2012 R2
- Windows Server 2008 R2
- Windows Server, version 2004 (Server Core installation)
- Windows Server, version 1909 (Server Core installation)

Description

The TCP/IP remote code execution vulnerability (CVE-2021-24074) allows an attacker to take control of a target host by crafting and sending malicious IPv4 or IPv6 packets. The Windows DNS Server remote code execution vulnerability (CVE-2021-24078) allows an attacker to execute arbitrary code on a Windows Server running the DNS service by crafting and sending a malicious DNS request. Install these patches as soon as possible to prevent exploitation.

Security recommendations

Apply the latest official patches immediately.

Solutions

Use one of the following solutions:

Download and apply the applicable patches from the official Microsoft website. For more information, see CVE-2021-24074 and CVE-2021-24078.
Use the Windows system vulnerabilities module in Alibaba Cloud Security Center to detect and patch these vulnerabilities with one click. For more information, log in to the Security Center console.
To mitigate the TCP/IP remote code execution vulnerability (CVE-2021-24074), you can set sourceroutingbehavior to drop by running
```
netsh int ipv4 set global sourceroutingbehavior=drop
```
.

References

Microsoft Security Update Guide

Announced by

Alibaba Cloud Computing Co., Ltd.