Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12310
HistoryOct 12, 2021 - 12:00 a.m.

KLA12310 Multiple vulnerabilities in Microsoft Windows

2021-10-1200:00:00
Kaspersky Lab
threats.kaspersky.com
28

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.512 Medium

EPSS

Percentile

97.5%

JSON

Detect date:

10/12/2021

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, obtain sensitive information, spoof user interface, execute arbitrary code, cause denial of service.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

Windows 10 for 32-bit Systems
Windows Server, version 2004 (Server Core installation)
Windows RT 8.1
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows Server, version 20H2 (Server Core Installation)
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2012 (Server Core installation)
Windows 10 Version 21H1 for ARM64-based Systems
Windows Server 2016 (Server Core installation)
Windows 10 Version 20H2 for 32-bit Systems
Windows 11 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2012 R2
Windows 10 Version 2004 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2022 (Server Core installation)
Windows 10 Version 1607 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2016
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 10 Version 2004 for ARM64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 20H2 for x64-based Systems
Windows 10 for x64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2012
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019
Windows Server 2022
Windows Server 2012 R2 (Server Core installation)
Windows 8.1 for x64-based systems
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 8.1 for 32-bit systems

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2021-40464
CVE-2021-40477
CVE-2021-41337
CVE-2021-40470
CVE-2021-41336
CVE-2021-40455
CVE-2021-41345
CVE-2021-41335
CVE-2021-40468
CVE-2021-40449
CVE-2021-40488
CVE-2021-38663
CVE-2021-40476
CVE-2021-41342
CVE-2021-26442
CVE-2021-40461
CVE-2021-41339
CVE-2021-40467
CVE-2021-41340
CVE-2021-41330
CVE-2021-40443
CVE-2021-40489
CVE-2021-40463
CVE-2021-40475
CVE-2021-41343
CVE-2021-41346
CVE-2021-40478
CVE-2021-40456
CVE-2021-40462
CVE-2021-36970
CVE-2021-38662
CVE-2021-41357
CVE-2021-41332
CVE-2021-40466
CVE-2021-41331
CVE-2021-38672
CVE-2021-40469
CVE-2021-41338
CVE-2021-40450
CVE-2021-41347
CVE-2021-36953
CVE-2021-40460
CVE-2021-26441
CVE-2021-40465
CVE-2021-40454
CVE-2021-41361
CVE-2021-41334

Impacts:

ACE

Related products:

Microsoft Office

CVE-IDS:

CVE-2021-369708.8Critical
CVE-2021-404555.5High
CVE-2021-386625.5High
CVE-2021-413357.8Critical
CVE-2021-404497.8Critical
CVE-2021-386635.5High
CVE-2021-413426.8High
CVE-2021-264427.0High
CVE-2021-413326.5High
CVE-2021-404667.8Critical
CVE-2021-413317.8Critical
CVE-2021-404697.2High
CVE-2021-413407.8Critical
CVE-2021-404677.8Critical
CVE-2021-369537.5Critical
CVE-2021-404897.8Critical
CVE-2021-404437.8Critical
CVE-2021-404606.5High
CVE-2021-404657.8Critical
CVE-2021-413435.5High
CVE-2021-404648.0Critical
CVE-2021-404777.8Critical
CVE-2021-413374.9Warning
CVE-2021-404707.8Critical
CVE-2021-413365.5High
CVE-2021-413457.8Critical
CVE-2021-404685.5High
CVE-2021-404887.8Critical
CVE-2021-404767.5Critical
CVE-2021-404618.0Critical
CVE-2021-413394.7Warning
CVE-2021-413307.8Critical
CVE-2021-404637.7Critical
CVE-2021-404755.5High
CVE-2021-413465.3High
CVE-2021-404787.8Critical
CVE-2021-404565.3High
CVE-2021-404627.8Critical
CVE-2021-413577.8Critical
CVE-2021-386728.0Critical
CVE-2021-413385.5High
CVE-2021-404507.8Critical
CVE-2021-413477.8Critical
CVE-2021-264417.8Critical
CVE-2021-404545.5High
CVE-2021-413615.4High
CVE-2021-413347.0High

KB list:

5006699
5006672
5006674
5006670
5006667
5006669
5006729
5006671
5006675
5006714

Microsoft official advisories:

References

Related

nessus 12
openvas 8
mskb 18
kaspersky 1
rapid7blog 1
thn 1
qualysblog 1
malwarebytes 1
threatpost 1
krebs 1
cve 46
prion 45
mscve 45
attackerkb 2
checkpoint_advisories 6
cisa_kev 2
zdi 6
githubexploit 1
metasploit 1
nessus
nessus
KB5006670: Windows 10 Version 2004 / Windows 10 Version 20H2 / Windows 10 Version 21H1 October 2021 Security Update
2021-10-12 00:00:00
KB5006667: Windows 10 version 1909 Security Update (October 2021)
2021-10-12 00:00:00
KB5006674: Windows 11 Security Update (October 2021)
2021-10-12 00:00:00
openvas
openvas
Microsoft Windows Multiple Vulnerabilities (KB5006667)
2021-10-13 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB5006674)
2023-08-07 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB5006670)
2021-10-13 00:00:00
mskb
mskb
October 12, 2021—KB5006699 (OS Build 20348.288)
2021-10-12 07:00:00
October 12, 2021—KB5006672 (OS Build 17763.2237)
2021-10-12 07:00:00
October 12, 2021—KB5006669 (OS Build 14393.4704) - EXPIRED
2021-10-12 07:00:00
kaspersky
kaspersky
KLA12309 Multiple vulnerabilities in Microsoft Products (ESU)
2021-10-12 00:00:00
rapid7blog
rapid7blog
Patch Tuesday - October 2021
2021-10-12 19:47:16
thn
thn
Update Your Windows PCs Immediately to Patch New 0-Day Under Active Attack
2021-10-13 05:49:00
qualysblog
qualysblog
Microsoft & Adobe Patch Tuesday (October 2021) – Microsoft 74 Vulnerabilities with 3 Critical, 4 Zero-Days. Adobe 10 Vulnerabilities
2021-10-13 14:14:18
malwarebytes
malwarebytes
Patch now! Microsoft fixes 71 Windows vulnerabilities in October Patch Tuesday
2021-10-13 15:41:24
threatpost
threatpost
Microsoft Oct. Patch Tuesday Squashes 4 Zero-Day Bugs
2021-10-12 21:51:06
krebs
krebs
Patch Tuesday, October 2021 Edition
2021-10-12 19:52:09
cve
cve
CVE-2021-41336
2021-10-13 01:15:00
CVE-2021-40456
2021-10-13 01:15:00
CVE-2021-41339
2021-10-13 01:15:00
prion
prion
Remote code execution
2021-10-13 01:15:00
Remote code execution
2021-10-13 01:15:00
Privilege escalation
2021-10-13 01:15:00
mscve
mscve
Win32k Elevation of Privilege Vulnerability
2021-10-12 07:00:00
Windows Hyper-V Remote Code Execution Vulnerability
2021-10-12 07:00:00
Microsoft DWM Core Library Elevation of Privilege Vulnerability
2021-10-12 07:00:00
attackerkb
attackerkb
CVE-2021-41357
2021-10-13 00:00:00
CVE-2021-40450
2021-10-13 00:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Win32k Elevation of Privilege (CVE-2021-41357)
2021-10-12 00:00:00
Microsoft DirectX Graphics Kernel Elevation of Privilege (CVE-2021-40470)
2021-10-12 00:00:00
Microsoft Windows Common Log File System Driver Elevation of Privilege (CVE-2021-40443)
2021-10-12 00:00:00
cisa_kev
cisa_kev
Microsoft Win32k Privilege Escalation Vulnerability
2022-04-25 00:00:00
Microsoft Win32k Privilege Escalation Vulnerability
2022-04-25 00:00:00
zdi
zdi
Microsoft Windows storport Integer Overflow Privilege Escalation Vulnerability
2021-10-14 00:00:00
Microsoft Windows storport Integer Overflow Privilege Escalation Vulnerability
2021-10-14 00:00:00
Microsoft Windows storport Integer Overflow Privilege Escalation Vulnerability
2021-10-14 00:00:00
githubexploit
githubexploit
Exploit for Use After Free in Microsoft
2021-10-20 09:24:36
metasploit
metasploit
Win32k NtGdiResetDC Use After Free Local Privilege Elevation
2021-11-09 16:36:40

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.512 Medium

EPSS

Percentile

97.5%

JSON
Related for KLA12310
nessus12openvas8mskb18kaspersky1rapid7blog1thn1qualysblog1malwarebytes1threatpost1krebs1cve46prion45mscve45attackerkb2checkpoint_advisories6cisa_kev2zdi6githubexploit1metasploit1