Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12024
HistoryDec 08, 2020 - 12:00 a.m.

KLA12024 Multiple vulnerabilities in Microsoft Windows

2020-12-0800:00:00
Kaspersky Lab
threats.kaspersky.com
25

8.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.3 High

AI Score

Confidence

Low

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.01 Low

EPSS

Percentile

83.2%

JSON

Detect date:

12/08/2020

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, bypass security restrictions, execute arbitrary code.

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products:

Windows Server, version 2004 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 R2 (Server Core installation)
Windows Server, version 1909 (Server Core installation)
Windows 10 Version 1607 for 32-bit Systems
Windows Server 2016
Windows Server 2019 (Server Core installation)
Windows 10 Version 20H2 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 8.1 for 32-bit systems
Windows 10 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1607 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows RT 8.1
Windows 10 Version 1803 for 32-bit Systems
Windows Server 2016 (Server Core installation)
Windows Server 2012 (Server Core installation)
Windows Server 2019
Windows 10 Version 1909 for 32-bit Systems
Windows 8.1 for x64-based systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 for 32-bit Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2012 R2
Windows Server, version 1903 (Server Core installation)
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2020-17103
CVE-2020-16964
CVE-2020-16960
CVE-2020-17140
CVE-2020-16962
CVE-2020-16963
CVE-2020-16961
CVE-2020-17099
CVE-2020-17098
CVE-2020-17097
CVE-2020-17096
CVE-2020-17095
CVE-2020-17094
CVE-2020-17092
CVE-2020-17138
CVE-2020-17139
CVE-2020-17134
CVE-2020-17136
CVE-2020-17137
CVE-2020-16996
CVE-2020-16959
CVE-2020-16958
ADV200013

Impacts:

ACE

Related products:

Microsoft Windows

CVE-IDS:

CVE-2020-171037.0High
CVE-2020-169647.8Critical
CVE-2020-169607.8Critical
CVE-2020-171408.1Critical
CVE-2020-169627.8Critical
CVE-2020-169637.8Critical
CVE-2020-169617.8Critical
CVE-2020-170996.8High
CVE-2020-170985.5High
CVE-2020-170973.3Warning
CVE-2020-170967.5Critical
CVE-2020-170958.5Critical
CVE-2020-170945.5High
CVE-2020-170927.8Critical
CVE-2020-171385.5High
CVE-2020-171397.8Critical
CVE-2020-171347.8Critical
CVE-2020-171367.8Critical
CVE-2020-171377.8Critical
CVE-2020-169966.5High
CVE-2020-169597.8Critical
CVE-2020-169587.8Critical

KB list:

4592449
4592440
4592438
4592484
4593226
4592495
4592497
4592446
4592464
4592468
5000822
5000847
5000808
5000803
5000848
5000802
5000853
5000840

Microsoft official advisories:

References

Related

nessus 10
mskb 22
kaspersky 1
attackerkb 1
googleprojectzero 1
rapid7blog 2
prion 22
cve 22
mscve 22
ibm 1
githubexploit 1
checkpoint_advisories 2
ubuntucve 1
qualysblog 1
zdt 1
metasploit 1
packetstorm 1
thn 1
threatpost 1
avleonov 1
nessus
nessus
KB4592440: Windows 10 Version 1809 and Windows Server 2019 December 2020 Security Update
2020-12-08 00:00:00
KB4592446: Windows 10 Version 1803 December 2020 Security Update
2020-12-08 00:00:00
KB4593226: Windows 10 Version 1607 and Windows Server 2016 December 2020 Security Update
2020-12-08 00:00:00
mskb
mskb
December 8, 2020—KB4592446 (OS Build 17134.1902) - EXPIRED
2020-12-08 08:00:00
December 8, 2020—KB4592449 (OS Builds 18362.1256 and 18363.1256) - EXPIRED
2020-12-08 08:00:00
December 8, 2020—KB4592464 (OS Build 10240.18782) - EXPIRED
2020-12-08 08:00:00
kaspersky
kaspersky
KLA12025 Multiple vulnerabilities in Microsoft Products (ESU)
2020-12-08 00:00:00
attackerkb
attackerkb
CVE-2020-17136
2020-12-10 00:00:00
googleprojectzero
googleprojectzero
Hunting for Bugs in Windows Mini-Filter Drivers
2021-01-14 00:00:00
rapid7blog
rapid7blog
Patch Tuesday - December 2020
2020-12-08 21:36:27
Metasploit Wrap-Up
2021-01-15 20:00:13
prion
prion
Information disclosure
2020-12-10 00:15:00
Privilege escalation
2020-12-10 00:15:00
Security feature bypass
2020-12-10 00:15:00
cve
cve
CVE-2020-17137
2020-12-10 00:15:00
CVE-2020-17099
2020-12-10 00:15:00
CVE-2020-17103
2020-12-10 00:15:00
mscve
mscve
DirectX Graphics Kernel Elevation of Privilege Vulnerability
2020-12-08 08:00:00
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
2020-12-08 08:00:00
Windows Backup Engine Elevation of Privilege Vulnerability
2020-12-08 08:00:00
ibm
ibm
Security Bulletin: Multiple Vulnerabilities in Windows Server supporting products bundled with Cloud Pak Systems
2021-04-06 23:03:35
githubexploit
githubexploit
Exploit for Vulnerability in Microsoft
2021-03-18 11:16:36
checkpoint_advisories
checkpoint_advisories
Microsoft Windows SMB Server Information Disclosure (CVE-2020-17140)
2020-12-08 00:00:00
Microsoft Windows SMB Remote Code Execution (CVE-2020-17096)
2020-12-08 00:00:00
ubuntucve
ubuntucve
CVE-2020-16996
2020-12-10 00:00:00
qualysblog
qualysblog
December 2020 Patch Tuesday – 58 Vulnerabilities, 9 Critical, Windows Exchange, Hyper-V, SharePoint, Adobe
2020-12-08 20:26:44
zdt
zdt
Cloud Filter Arbitrary File Creation / Privilege Escalation Exploit
2021-01-12 00:00:00
metasploit
metasploit
CVE-2020-1170 Cloud Filter Arbitrary File Creation EOP
2021-01-04 18:04:38
packetstorm
packetstorm
Cloud Filter Arbitrary File Creation / Privilege Escalation
2021-01-12 00:00:00
thn
thn
Microsoft Releases Windows Update (Dec 2020) to Fix 58 Security Flaws
2020-12-09 04:57:00
threatpost
threatpost
Microsoft Wraps Up a Lighter Patch Tuesday for the Holidays
2020-12-08 20:23:30
avleonov
avleonov
Vulristics Vulnerability Score, Automated Data Collection and Microsoft Patch Tuesdays Q4 2020
2021-01-11 01:50:44

8.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.3 High

AI Score

Confidence

Low

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.01 Low

EPSS

Percentile

83.2%

JSON
Related for KLA12024
nessus10mskb22kaspersky1attackerkb1googleprojectzero1rapid7blog2prion22cve22mscve22ibm1githubexploit1checkpoint_advisories2ubuntucve1qualysblog1zdt1metasploit1packetstorm1thn1threatpost1avleonov1