KLA12479 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products (Extended Security Update). Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service, execute arbitrary code, gain privileges, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in Windows Common Log File System Driver can be exploited remotely to obtain sensitive information.
2. A denial of service vulnerability in Windows Media Center Update can be exploited remotely to cause denial of service.
3. A remote code execution vulnerability in Remote Desktop Client can be exploited remotely to execute arbitrary code.
4. An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges.
5. An elevation of privilege vulnerability in Windows Security Support Provider Interface can be exploited remotely to gain privileges.
6. An elevation of privilege vulnerability in Windows Fast FAT File System Driver can be exploited remotely to gain privileges.
7. An information disclosure vulnerability in Remote Desktop Protocol Client can be exploited remotely to obtain sensitive information.
8. A security feature bypass vulnerability in Windows HTML Platforms can be exploited remotely to bypass security restrictions.
9. An information disclosure vulnerability in Windows NT Lan Manager Datagram Receiver Driver can be exploited remotely to obtain sensitive information.
10. An elevation of privilege vulnerability in Windows NT OS Kernel can be exploited remotely to gain privileges.
11. A denial of service vulnerability in Point-to-Point Tunneling Protocol can be exploited remotely to cause denial of service.
12. An elevation of privilege vulnerability in Windows ALPC can be exploited remotely to gain privileges.
13. An elevation of privilege vulnerability in Windows Fax and Scan Service can be exploited remotely to gain privileges.
14. An elevation of privilege vulnerability in Windows PDEV can be exploited remotely to gain privileges.
15. An elevation of privilege vulnerability in Windows Inking COM can be exploited remotely to gain privileges.

Original advisories

CVE-2022-23281

CVE-2022-21973

CVE-2022-23285

CVE-2022-23296

CVE-2022-24454

CVE-2022-23293

CVE-2022-24503

CVE-2022-24502

CVE-2022-23297

CVE-2022-23298

CVE-2022-23253

CVE-2022-23283

CVE-2022-24459

CVE-2022-21990

CVE-2022-23299

CVE-2022-23290

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-Server-2012

Microsoft-Windows-8

Microsoft-Windows-7

Microsoft-Windows-Server-2008

Windows-RT

Microsoft-Windows-10

Microsoft-Windows-Server-2016

Microsoft-Windows-Server-2019

CVE list

CVE-2022-23281 high

CVE-2022-21973 high

CVE-2022-23285 critical

CVE-2022-23296 critical

CVE-2022-24454 critical

CVE-2022-23293 critical

CVE-2022-24503 high

CVE-2022-24502 warning

CVE-2022-23297 high

CVE-2022-23298 high

CVE-2022-23253 high

CVE-2022-23283 high

CVE-2022-24459 critical

CVE-2022-21990 critical

CVE-2022-23299 critical

CVE-2022-23290 critical

KB list

5011525

5011534

5011552

5011529

5011486

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Windows 10 Version 21H1 for 32-bit SystemsWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Windows 7 for 32-bit Systems Service Pack 1Windows 10 Version 1909 for ARM64-based SystemsWindows 10 Version 21H2 for x64-based SystemsWindows 8.1 for 32-bit systemsWindows Server 2012 (Server Core installation)Windows Server 2016Windows Server 2022 Azure Edition Core HotpatchWindows 10 Version 1809 for ARM64-based SystemsWindows RT 8.1Windows Server 2022Windows Server 2012Windows 10 Version 1607 for 32-bit SystemsWindows 10 Version 1809 for 32-bit SystemsWindows Server 2019Windows 10 Version 1909 for x64-based SystemsWindows 10 Version 1909 for 32-bit SystemsWindows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows 10 Version 21H2 for 32-bit SystemsWindows 10 Version 20H2 for x64-based SystemsWindows 7 for x64-based Systems Service Pack 1Windows 8.1 for x64-based systemsWindows 10 Version 21H2 for ARM64-based SystemsWindows 10 for x64-based SystemsWindows Server 2012 R2 (Server Core installation)Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server, version 20H2 (Server Core Installation)Windows 10 for 32-bit SystemsWindows Server 2016 (Server Core installation)Windows Server 2012 R2Windows 10 Version 1809 for x64-based SystemsWindows 10 Version 20H2 for 32-bit SystemsWindows 11 for ARM64-based SystemsWindows Server 2019 (Server Core installation)Windows Server 2008 R2 for x64-based Systems Service Pack 1Windows Server 2022 (Server Core installation)Windows 10 Version 21H1 for ARM64-based SystemsWindows 11 for x64-based SystemsWindows 10 Version 21H1 for x64-based SystemsWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Windows 10 Version 1607 for x64-based SystemsRemote Desktop client for Windows DesktopWindows 10 Version 20H2 for ARM64-based Systems