CVE-2021-42293 : Security Advisory and Response

Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability was published on December 15, 2021.

Understanding CVE-2021-42293

What is CVE-2021-42293?

The CVE-2021-42293 is an Elevation of Privilege vulnerability in Microsoft Jet Red Database Engine and Access Connectivity Engine.

The Impact of CVE-2021-42293

This vulnerability has a CVSS base score of 6.5 (Medium severity), allowing an attacker to elevate privileges on the affected system.

Technical Details of CVE-2021-42293

Vulnerability Description

Title: Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability

Affected Systems and Versions

The following Microsoft products and versions are impacted:

Microsoft Office LTSC 2021 (16.0.1)
Microsoft Office 2019 (19.0.0)
Microsoft 365 Apps for Enterprise (16.0.1)
Microsoft Office 2016 (16.0.0)
Microsoft Office 2013 Service Pack 1 (15.0.0)

Exploitation Mechanism

The vulnerability affects x64-based, 32-bit, and ARM64-based systems, allowing attackers to exploit it for privilege escalation.

Mitigation and Prevention

Immediate Steps to Take

Apply security updates from Microsoft.
Monitor for any unusual activities on the network.
Restrict user privileges to reduce the impact of privilege escalation.

Long-Term Security Practices

Regularly update software and systems.
Conduct security assessments to identify vulnerabilities.
Implement a least privilege principle to limit access.

Patching and Updates

Regularly check for security updates from Microsoft and apply them promptly.