Pricing
Contact
Login
Start Free Trial
Back

February Trending CVEs: CVE-2021-24078

Mar 11, 2021

As stewards of the lush and vast landscape of security vulnerabilities, we felt obliged to share with you the top trending CVEs of the past month (who's excited for winter to be over?! đŸ˜â˜€ď¸đŸŒˇ). Brace yourself! Ok, here we go.

CVE-2021-24078

Microsoft rolled out updates to plug some security holes in its Windows operating systems and other software. A major concern for enterprises is a critical bug in the DNS service on Windows Server 2008 through 2019 that can be used to remotely install software of the attacker’s choice. CVE-2021-24078 earned a CVSS score of 9.8, which is as risky as they come. 

This vulnerability can be exploited remotely by getting a vulnerable DNS server to query for a domain it has not come across before. For example, sending a phishing email with a link to a new domain or images embedded that call out to a new domain. 

CVE-2021-24078 could let a cyber attacker steal lots of data by changing the destination for the web traffic of an organization. For instance, pointing internal appliances or outlook email access at a malicious server. 

Latest Updates and Solutions

  • With February 2021 security patches, Microsoft has started to reject insecure Netlogon attempts from non-Windows devices. 
  • While staying up-to-date on Windows patches is essential, it’s important that you are updating only after you have backed up your important files and data. 
  • A reliable backup means you are less likely to have any issues with your data when the odd patch causes problems booting the system.
  • Do yourself a favor and back up your files before installing any patches. 
  • Windows 10 also has some built-in tools that can assist you with a backup process, either on a per-file basis or making a complete and bootable copy of your hard drive at once.

Visit the Vicarius Research Center for more information on CVEs and how to remediate them. You can also try a 30-day free trial of our TOPIA solution.

Prefer to listen instead? We got you covered 😏

CVE-2021-24078 could let a cyber attacker steal lots of data by changing the destination for the web traffic of an organization.

users/photos/ckzu2qthc003w0jnd2nqodctm.jpg

Written by

Kent Weigle

Recent Posts

  • 1

    Microsoft Windows Contacts (VCF/Contact/LDAP) syslink control href attribute escape vulnerability (CVE-2022-44666) (0day)

    j00sean (https://twitter.com/j00sean) July 11, 2023
  • 2

    CVE-2021-38294: Apache Storm Nimbus Command Injection

    Zeyad Abdelazim June 20, 2023
  • 3

    CVE-2023-21931 & CVE-2023-21839 RCE via post-deserialization

    Mohammad Hussam Alzeyyat June 19, 2023
  • 4

    Have you missed them? The new reports feature is here!

    Noa Machter May 14, 2023
  • 5

    CVE-2021-45456 Apache Kylin RCE Exploit

    Mohammad Hussam Alzeyyat April 30, 2023

Related Posts

By David Parkinson Frost
Oct 03, 2023

Rasputin Says David Has Mystic Powers

By Vicarius Studios .
Oct 02, 2023

Wake Me Up When Patch Tuesday Ends

By Basant Singh
Sep 30, 2023

Analysis for OpenSSH Double Free Pre-Authentication

Exploring CVE-2023-25136: The OpenSSH Pre-Auth Double Free Vulnerability
last_chanse_02.png

Start Closing Security Gaps

  • Risk reduction from Day 1
  • Fast set-up and deployment
  • Unified platform
  • Full-featured 14-day trial
Start Free Trial!

Have questions?

By submitting this form, you agree to be contacted about vRx and other Vicarius products.

Vicarius develops an autonomous vulnerability remediation platform to help security teams protect their assets against software exploitation. Consolidating vulnerability assessment, prioritization, and remediation, Vicarius strengthens cyber hygiene and proactively reduces risk.
We're hiring!

Support

support@vicarius.io

Sales

sales@vicarius.io

Marketing

info@vicarius.io
Product
Product Overview
Vulnerability Management
Patch Management
Patchless Protection
Auto Actions
Reporting
Network Scanner
xTags
0-Day Detection
Solution
Solution Overview
Case Studies
Knowledge
Research Center
Apps & OS Patch Catalog
Videos
Articles
Docs
Company
About
Investors
vconnect
Trust
Careers
Pricing
Pricing
Compare
vRx vs. Automox
vRx vs. ManageEngine
vRx vs. Rapid7
vRx vs. Tenable
vRx vs. Tanium
vRx vs. RMMs
vRx vs. Vulcan
vRx vs. PDQ
vRx vs. Qualys
vRx vs. SentinelOne
vRx vs. BigFix

Copyright Š Vicarius. All rights reserved 2022. Privacy Policy and Terms of Use