Lucene search

K
kasperskyKaspersky LabKLA12226
HistoryJul 13, 2021 - 12:00 a.m.

KLA12226 Multiple vulnerabilities in Microsoft Products (ESU)

2021-07-1300:00:00
Kaspersky Lab
threats.kaspersky.com
16

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

Detect date:

07/13/2021

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Products (Extended Security Update). Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges.

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products:

Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows Server 2012
Windows RT 8.1
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 for 32-bit Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for x64-based systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2016 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows Server 2012 (Server Core installation)
Windows 10 Version 21H1 for 32-bit Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012 R2
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server, version 2004 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 1809 for x64-based Systems

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2021-33783
CVE-2021-34492
CVE-2021-34497
CVE-2021-34442
CVE-2021-34444
CVE-2021-33765
CVE-2021-34504
CVE-2021-33786
CVE-2021-34456
CVE-2021-34494
CVE-2021-33788
CVE-2021-33754
CVE-2021-34446
CVE-2021-33752
CVE-2021-31183
CVE-2021-33750
CVE-2021-33745
CVE-2021-31979
CVE-2021-33756
CVE-2021-34440
CVE-2021-33749
CVE-2021-33764
CVE-2021-34448
CVE-2021-34499
CVE-2021-33757
CVE-2021-34457
CVE-2021-34441
CVE-2021-34507
CVE-2021-33746
CVE-2021-34498
CVE-2021-34516
CVE-2021-34447
CVE-2021-33780
CVE-2021-34476
CVE-2021-34511
CVE-2021-33782
CVE-2021-34514
CVE-2021-34500
CVE-2021-34496

Impacts:

ACE

Related products:

Microsoft Windows

CVE-IDS:

CVE-2021-344976.8High
CVE-2021-344446.5High
CVE-2021-345047.8Critical
CVE-2021-344567.8Critical
CVE-2021-337887.5Critical
CVE-2021-344948.8Critical
CVE-2021-344468.0Critical
CVE-2021-311837.5Critical
CVE-2021-337456.5High
CVE-2021-344405.5High
CVE-2021-337498.8Critical
CVE-2021-337645.9High
CVE-2021-337575.3High
CVE-2021-344417.8Critical
CVE-2021-345076.5High
CVE-2021-345167.8Critical
CVE-2021-337808.8Critical
CVE-2021-344767.5Critical
CVE-2021-345117.8Critical
CVE-2021-345006.3High
CVE-2021-344965.5High
CVE-2021-337836.5High
CVE-2021-344928.1Critical
CVE-2021-344428.8Critical
CVE-2021-337656.2High
CVE-2021-337868.1Critical
CVE-2021-337548.0Critical
CVE-2021-337528.8Critical
CVE-2021-337508.8Critical
CVE-2021-319797.8Critical
CVE-2021-337568.8Critical
CVE-2021-344486.8High
CVE-2021-344996.5High
CVE-2021-344575.5High
CVE-2021-337468.0Critical
CVE-2021-344987.8Critical
CVE-2021-344476.8High
CVE-2021-337825.5High
CVE-2021-345147.8Critical

KB list:

5004289
5004307
5004299
5004305
5005563
5010384
5010422
5010403
5010404

Microsoft official advisories:

References

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C