KLA12258 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, gain privileges, cause denial of service.

Below is a complete list of vulnerabilities:

1. A security bypass Microsoft Azure can be exploited remotely to bypass security restrictions.
2. An information disclosure vulnerability in Azure Sphere can be exploited remotely to obtain sensitive information.
3. An elevation of privilege vulnerability in Azure Sphere can be exploited remotely to gain privileges.
4. An elevation of privilege vulnerability in Azure CycleCloud can be exploited remotely to gain privileges.
5. A denial of service vulnerability in Azure Sphere can be exploited remotely to cause denial of service.

Original advisories

CVE-2021-36949

CVE-2021-26428

CVE-2021-26429

CVE-2021-36943

CVE-2021-33762

CVE-2021-26430

Related products

Microsoft-Active-Directory

Microsoft-Azure

CVE list

CVE-2021-36949 unknown

CVE-2021-26428 unknown

CVE-2021-26429 unknown

CVE-2021-36943 unknown

CVE-2021-33762 unknown

CVE-2021-26430 unknown

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft Azure Active Directory Connect 2.0.X.YAzure Active Directory Connect Provisioning AgentAzure SphereAzure CycleCloud 8.2.0