September 8, 2021
Microsoft has identified a couple of attacks that target a remote code execution vulnerability in MSHTML that affects Microsoft Windows. This also prompted CISA to issue a statement asking “users and organizations to review Microsoft’s mitigations and workarounds to address the remote code execution vulnerability identified as CVE-2021-40444.”
Rick Cole of Microsoft Security Response Center, Haifei Li of EXPMON, Dhanesh Kizhakkinan, Bryce Abdo, and Genwei Jiang of Mandiant discovered the vulnerability.
The Microsoft release mentions that its Defender Antivirus and Defender for Endpoint protect against the vulnerability, so anyone who has the tools and uses automatic updates is safe from the vulnerability. The tech giant also pointed out that enterprise customers who manage updates should “select the detection build 1.349.22.0 or newer and install it across their environments.”
The notifications in Microsoft Defender are displayed as “Suspicious Cpl File Execution.”
Once the investigation is complete, Microsoft will release a security update during Patch Tuesday or in a separate out-of-cycle security update.
In addition, this version adds that Microsoft Office opens documents from the internet in Protected View or Application Guard for Office by default, both of which prevent the attack.
Microsoft recommends disabling the installation of all ActiveX controls in Internet Explorer.
The statement also gave instructions on how to disable ActiveX controls on an individual system.
For more information, read the original story in ZDNet.
