Microsoft Patch Tuesday – December 2021

Patch Tuesday is once again upon us. The December 2021 edition of Patch Tuesday brings us 68 fixes, 7 of which are rated as critical. This month also includes a windows 10 version going end of life. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the December 2021 Patch Tuesday Audit Report

Windows 10 Version 2004 End of Life

Windows 10 version 2004 will, unlike others, go end of life in one big sweep. No matter what edition of Windows 10 you have, version 2004 is end of life starting today! Luckily, we’re prepared and we already have a Windows 10 end-of-life report that provides an overview of all current Windows 10 versions in your environment along with how many days are left until it is no longer supported.

iSNS Server Memory Corruption Vulnerability

With a CVSS 3.1 base score of 9.8, CVE-2021-43215 is one of the most critical vulnerabilities in this month’s patch Tuesday.

iSNS, or the Internet Storage Name Service protocol is used for communication between iSNS servers and iSNS clients. As the name would suggest iSNS manages an Internet Storage Name Service server that provides registration functionality in a storage network so that registering and querying the iSNS database is possible. Luckily iSNS isn’t something that is installed by default, so there is less chance you’re affected.

To quickly find which if your servers have the iSNS feature installed, the report below will provide you a quick overview.

Windows Encrypting File System (EFS) RCE

Windows’ EFS also received a patch, even when EFS isn’t in use, attackers can still exploit this vulnerability by causing a buffer overflow. This allows attackers to perform unauthenticated non-sandboxed code execution.

What’s special about this vulnerability is that it is being fixed in two stages. Stage 1 starts with today’s patch and will enable packet-level privacy for EFS when the client initiates a connection, and the server will only allow connections with packet-level privacy. Stage 2 will happen in Q1 2022, support for the AllowAllCliAuth registry key will be removed and servers will require packet-level privacy regardless of the registry key setting.

Run the Patch Tuesday December 2021 Audit Report

To help manage your update progress, we’ve created the Patch Tuesday Audit Report that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see at a glance which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

Patch Tuesday December 2021 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" indicates required fields

Email*

This field is hidden when viewing the form

EmailType

This field is hidden when viewing the form

IM – Conv Page – Processing

This field is hidden when viewing the form

IM – UTM_Campaign FC – Processing

This field is hidden when viewing the form

IM – UTM_Campaign LC – Processing

This field is hidden when viewing the form

IM – UTM_Content FC – Processing

This field is hidden when viewing the form

IM – UTM_Content LC – Processing

This field is hidden when viewing the form

IM – UTM_Medium FC – Processing

This field is hidden when viewing the form

IM – UTM_Medium LC – Processing

This field is hidden when viewing the form

IM – UTM_Source FC – Processing

This field is hidden when viewing the form

IM – UTM_Source LC – Processing

This field is hidden when viewing the form

IM – UTM_Term FC – Processing

This field is hidden when viewing the form

IM – UTM_Term LC – Processing

This field is hidden when viewing the form

gclid

This field is hidden when viewing the form

msclkid

Comments

This field is for validation purposes and should be left unchanged.

Count Me In Submit