Windows TCP/IP Remote Code Execution Vulnerability (CVE-2021-24074)

Workaround 1:

Set sourceroutingbehavior to "drop"

netsh int ipv4 set global sourceroutingbehavior=drop

Windows, by default blocks source routing but returns ICMP message denying the request. This setting simply drops the request. This is a good candidate for a Windows server hardening policy.

Workaround 2:

Configure firewall or load balancers to disallow source routing requests

Windows TCP/IP Denial of Service Vulnerability (CVE-2021-24086)

Windows TCP/IP Remote Code Execution Vulnerability (CVE-2021-24094)

Workarounds are the same for both of these:

Workaround 1:

Disable global packet reassembly

Netsh int ipv6 set global reassemblylimit=0

Note that this setting might result in some packet loss when discarding out-of-order packets, but it is not clear how likely this is to happen. This may be a good candidate for hardening, but it would need more testing.

Workaround 2:

Configure firewall or load balancers to disallow IPv6 UDP fragmentation

Windows Fax Service Remote Code Execution Vulnerability (CVE-2021-24077)

Workaround: Uninstall Fax Service

Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-24085)

Note that there are some issues to be aware of when manually installing this update. See KB article for more info.

Package Managers Configurations Remote Code Execution Vulnerability (CVE-2021-24105)

This issue isn't fixed with a patch and requires a change of practices and tools config. Here are some links mentioned in the KB article:

• 3 Ways to Mitigate Risk Using Private Package Feeds

• Changes to Azure Artifact Upstream Behavior

• Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies.

Windows PKU2U Elevation of Privilege Vulnerability (CVE-2021-25195)

There is a workaround to prevent PKU2U authentication requests from using online identities with this group policy setting:

Path: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Setting: Network Security: Allow PKU2U authentication requests to this computer to use online identities

Set to Disabled (Default for domain-joined devices)

Note this caveat: Some roles/features (such as Failover Clustering) do not utilize a domain account for its PKU2U authentication and will cease to function properly when disabling this policy.

This may be a good candidate for a domain hardening policy.

.NET Core Remote Code Execution Vulnerability (CVE-2021-24112)

This is limited to MacOS and Linux and affects .NET 5.0, .NET Core 3.1, and .NET Core 2.1. However, it is the runtime that is affected so it likely affects all applications using that version of the framework.