CVE-2021-28455HighCVSS 8.8

Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability

Published
May 11, 2021
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2021-28455 →

📋 Description

Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

How do the security updates address this vulnerability? The security updates address the vulnerability by providing the ability to configure the Jet Red Database Engine or Access Connectivity Engine to block access to remote databases. You might need to do this when you allow unprivileged users to run custom SQL queries in JET or ACE. See KB5002984: Configuring Jet Red Database Engine and Access Connectivity Engine to block access to remote databases for more information. If I do not disable these SQL queries, is there any other way I can be protected from this vulnerability? No. Allowing ‘External database queries’ can expose you to security risks if you accept adhoc SQL queries or have a SQL injection flaw in your system which could allow an unknown user to specify ‘external databases’ – this could open you to a possible security exploit. If you understand the risks and are confident you do not have a SQL adhoc/injection flaw you could consider not disabling this feature. If after disabling the registry values as listed in KB5002984 you choose to re-enable them, it might make your device vulnerable to attack by a malicious user or malicious software. We do not recommend that you re-enable these registry values but are providing this information so that you can choose to implement this at your own discretion. Use this at your own risk.

🎯 Affected products53

  • Microsoft 365 Apps for Enterprise for 32-bit Systems
  • Microsoft 365 Apps for Enterprise for 64-bit Systems
  • Microsoft Access 2013 Service Pack 1 (32-bit editions)
  • Microsoft Access 2013 Service Pack 1 (64-bit editions)
  • Microsoft Access 2016 (32-bit edition)
  • Microsoft Access 2016 (64-bit edition)
  • Microsoft Office 2013 RT Service Pack 1
  • Microsoft Office 2013 Service Pack 1 (32-bit editions)
  • Microsoft Office 2013 Service Pack 1 (64-bit editions)
  • Microsoft Office 2016 (32-bit edition)
  • Microsoft Office 2016 (64-bit edition)
  • Microsoft Office 2019 for 32-bit editions
  • Microsoft Office 2019 for 64-bit editions
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1803 for 32-bit Systems
  • Windows 10 Version 1803 for ARM64-based Systems
  • Windows 10 Version 1803 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 2004 for 32-bit Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 for 32-bit Systems
  • +23 more not shown

✅ Remediation

KB4484527 (Security Update) — fixed build 15.0.5353.1000 KBClick to Run (Security Update) — fixed build https://aka.ms/OfficeSecurityReleases KB4493197 (Security Update) — fixed build 16.0.5161.1001 KB4504711 (Security Update) KB4493206 (Security Update) — fixed build 15.0.5345.1001 KB5003174 (Security Update) — fixed build 10.0.17134.2207 KB5003171 (Security Update) — fixed build 10.0.17763.1935 KB5003169 (Security Update) — fixed build 10.0.18363.1556 KB5003173 (Security Update) — fixed build 10.0.19041.982 KB5003173 (Security Update) — fixed build 10.0.19042.982 KB5003172 (Security Update) — fixed build 10.0.10240.18931 KB5003197 (Security Update) — fixed build 10.0.14393.4401 KB5003233 (Monthly Rollup) — fixed build 6.1.7601.24597 KB5003228 (Security Only) — fixed build 6.1.7601.24598 KB5003209 (Monthly Rollup) — fixed build 6.3.9600.20017 KB5003220 (Security Only) — fixed build 6.3.9600.20017 KB5003210 (Monthly Rollup) — fixed build 6.0.6003.21117 KB5003225 (Security Only) — fixed build 6.0.6003.21117 KB5003208 (Monthly Rollup) — fixed build 6.2.9200.23347 KB5003203 (Security Only) — fixed build 6.2.9200.23347

🔗 References (35)