Full Report
Microsoft has released its monthly security update for January of 2025 which includes 58 vulnerabilities, including 3 that Microsoft marked as “critical” and one marked as "moderate". The remaining vulnerabilities listed are classified as “important.”
Analysis Summary
# Vulnerability: Microsoft's February 2025 Security Updates
## CVE Details
- CVE ID: CVE-2025-21376, CVE-2025-21379, CVE-2025-21177, CVE-2025-21381, CVE-2025-21368, CVE-2025-21369, CVE-2025-21400, CVE-2025-21391, CVE-2025-21418, and others.
- CVSS Score: 8.1 (Critical for CVE-2025-21376), 7.1 (Critical for CVE-2025-21379), 8.8 (Important for CVE-2025-21368/21369). (Severity varies widely across the 63 disclosed vulnerabilities.)
- CWE: Out-of-bounds Write (CWE-787) for CVE-2025-21376; Server-Side Request Forgery (SSRF) for CVE-2025-21177.
## Affected Systems
- Products: Windows (LDAP, DHCP Client Service, Ancillary Function Driver - AFD), Microsoft Dynamics 365 Sales, Microsoft Excel, Microsoft SharePoint Server, Windows Telephony Service, Windows Routing and Remote Access Service (RRAS), Microsoft HPC Pack.
- Versions: Not specified in the summary, but covers a range of Microsoft products addressed in the February 2025 security update.
- Configurations: Specific configurations vary per CVE (e.g., CVE-2025-21379 requires an attacker to be in the logical network path).
## Vulnerability Description
Microsoft released patches for 63 vulnerabilities in February 2025, including 4 critical flaws. Key technical details include:
* **CVE-2025-21376 (Windows LDAP RCE):** An Out-of-bounds Write caused by a race condition allows for arbitrary code execution in `lsass.exe`. Exploitation requires winning this race condition.
* **CVE-2025-21379 (DHCP Client RCE):** Allows arbitrary code execution if an attacker injects themselves into the logical network path between the target and the requested resource.
* **CVE-2025-21177 (Dynamics 365 Privilege Escalation):** An SSRF vulnerability allowing an authorized attacker to elevate privileges over a network.
* **CVE-2025-21381 (Excel RCE):** Can be triggered via the preview pane.
* **CVE-2025-21368/21369 (RCE):** Exploitable by sending a malicious logon request to a domain controller (requires authentication, but not admin privileges).
* **CVE-2025-21400 (SharePoint RCE):** Requires a client to connect to a malicious server to gain code execution on the client.
## Exploitation
- Status: **Exploited in the wild** for CVE-2025-21391 and CVE-2025-21418 (both privilege escalation). PoC/exploitation status for others is not explicitly listed but some are rated "more likely to be exploited" (e.g., CVE-2025-21376, CVE-2025-21400).
- Complexity: Varies. CVE-2025-21376 requires winning a race condition; CVE-2025-21368/21369 require authentication.
- Attack Vector: Network (RCE, SSRF), Adjacent (DHCP), Local (LPE).
## Impact
- Confidentiality: High (Implied by RCE vulnerabilities, and potential information disclosure in LPE).
- Integrity: High (Arbitrary code execution, Privilege Escalation, system file deletion via CVE-2025-21391).
- Availability: High (Implied by RCE allowing system compromise).
## Remediation
### Patches
Patches are available via Microsoft's February 2025 Security Update. Specific patched versions are not detailed in the source text but are included in the update package.
### Workarounds
No specific application-level workarounds were mentioned in the provided description. Defense relies primarily on immediate patching.
## Detection
- Indicators of Compromise: Attack attempts related to CVE-2025-21376 (LDAP/lsass interaction), malicious logon requests (CVE-2025-21368/21369), or Winsock API exploitation (CVE-2025-21418).
- Detection methods and tools: New Snort rule sets have been released to detect exploitation attempts:
* Snort Rules: 58316, 58317, 62022, 62023, 64529-64532, 64537, 64539-64542, 64545.
* Snort 3 Rules: 300612, 301136, 301137, 301139, 301140.
* Cisco Security Firewall users must apply the latest SRU update.
## References
- Vendor Advisories: Microsoft's February 2025 Security Update Guide.
- Relevant links: msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21376, snort.org