Alert GCSA-17040 - Microsoft Security Update Luglio 2017

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

******************************************************************

   Alert ID: GCSA-17040
   Data: 12 luglio 2017
   Titolo: Microsoft Security Update Luglio 2017

******************************************************************

:: Descrizione del problema

   Microsoft ha rilasciato aggiornamenti mirati a risolvere
   54 vulnerabilita', delle quali 19 critiche, presenti nei
   sistemi operativi Windows e in vari software applicativi.

   In particolare la vulnerabilita'

   CVE-2017-8589 Windows Search Remote Code Execution Vulnerability

   potrebbe essere innescata da remoto da un aggressore non
   autenticato, attraverso il protocollo Server Message Block (SMB).

   Sebbene questa vulnerabilita' sfrutti l'SMB come vettore di attacco,
   non riguarda l'SMB stesso, e non e' correlata alle recenti vulnerabilita'
   SMB sfruttate da EternalBlue, WannaCry e NoPetya.

   Maggiori dettagli nella sezione "Riferimenti".


:: Software interessato

   Internet Explorer
   Microsoft Edge
   Microsoft Windows
   Microsoft Office and Microsoft Office Services and Web Apps
   .NET Framework
   Adobe Flash Player
   Microsoft Exchange Server


:: Impatto

   Esecuzione remota di codice arbitrario (RCE)
   Acquisizione di privilegi piu' elevati
   Cross-site scripting (XSS)
   Bypass delle funzionalita' di sicurezza


:: Soluzioni

   Per default l'installazione degli aggiornamenti
   avviene in maniera automatica.

   Windows Update domande frequenti
   https://support.microsoft.com/it-it/help/12373/windows-update-faq


:: Riferimenti

   Microsoft July 2017 Security Release
   https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/f2b16606-4945-e711-80dc-000d3a32fc99

   Microsoft Security Update Summary
   https://portal.msrc.microsoft.com/en-us/security-guidance/summary
   https://portal.msrc.microsoft.com/en-us/security-guidance

   Microsoft Security Update deployment information
   https://support.microsoft.com/en-us/help/20170711/security-update-deployment-information-july-11-2017

   Riferimenti CVE
   https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8590
   https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8589
   https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8589
   https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8565
   https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8495
   https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8588
   https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8463
   https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170009

   SANS ISC Diary
   https://isc.sans.edu/diary/rss/22602

   Kaspersky Threatpost
   https://threatpost.com/microsoft-patch-tuesday-update-fixes-19-critical-vulnerabilities/126758/

   Zero Day Initiative
   https://www.zerodayinitiative.com/blog/2017/7/11/the-july-2017-security-update-review



GARR CERT Security Alert -  subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iD8DBQFZZd1AwZxMk2USYEIRAr/1AKDQ35h1zOrvMQAaYq5zhu+8wNNdDwCfcnS8
ksElA5sEoG9THpTjF3IdzN4=
=zu2D
-----END PGP SIGNATURE-----