Alert GCSA-21086 - Microsoft Security Update Agosto 2021
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ****************************************************************** alert ID: GCSA-21086 data: 11 agosto 2021 titolo: Microsoft Security Update Agosto 2021 ****************************************************************** :: Descrizione del problema Microsoft ha rilasciato il security update mensile per agosto 2021, questa versione risolve 51 vulnerabilita', delle quali 7 sono classificate come "critiche". E' stato confermato che le seguente vulnerabilita' e' in corso di sfruttamento: CVE-2021-36948 Windows Update Medic Service elevation of privilege vulnerability esistono anche altre due vulnerabilita' di tipo zero-day divulgate pubblicamente: CVE-2021-36936 Windows Print Spooler remote code execution vulnerability CVE-2021-36942 Windows LSA spoofing vulnerability Maggiori dettagli sono disponibili alla sezione "Riferimenti". :: Software interessato .NET Core & Visual Studio ASP .NET Azure Azure Sphere Microsoft Azure Active Directory Connect Microsoft Dynamics Microsoft Graphics Component Microsoft Office Microsoft Office SharePoint Microsoft Office Word Microsoft Scripting Engine Microsoft Windows Codecs Library Remote Desktop Client Windows Bluetooth Service Windows Cryptographic Services Windows Defender Windows Event Tracing Windows Media Windows MSHTML Platform Windows NTLM Windows Print Spooler Components Windows Services for NFS ONCRPC XDR Driver Windows Storage Spaces Controller Windows TCP/IP Windows Update Windows Update Assistant Windows User Profile Service :: Impatto Esecuzione remota di codice arbitrario (RCE) Denial of Service (DoS) Acquisizione di privilegi piu' elevati (EoP) Provide Misleading Information (spoofing) Information Disclosure (ID) Bypass delle funzionalita' di sicurezza (SFB) :: Soluzioni Per default l'installazione degli aggiornamenti avviene in maniera automatica. Per installare manualmente scegliere Start > Impostazioni > Aggiornamento e Sicurezza > Windows Update Verificare di aver installato la versione piu' recente del Servicing Stack Updates https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV990001 https://docs.microsoft.com/it-it/windows/deployment/update/servicing-stack-updates Windows Update domande frequenti https://support.microsoft.com/en-us/help/12373/windows-update-faq Gli aggiornamenti sono disponibili anche tramite il catalogo di Microsoft Update https://www.catalog.update.microsoft.com/ Gli utenti che utilizzano ancora Windows 7, Windows Server 2008 o 2008 R2 devono acquistare l'Extended Security Update per continuare a ricevere gli aggiornamenti https://support.microsoft.com/en-hk/help/4522133/procedure-to-continue-receiving-security-updates :: Riferimenti Microsoft Security Updates - Release Notes https://msrc.microsoft.com/update-guide/releaseNote/2021-Aug ISC SANS https://isc.sans.edu/forums/diary/Microsoft+August+2021+Patch+Tuesday/27736/ Krebs on Security https://krebsonsecurity.com/2021/08/microsoft-patch-tuesday-august-2021-edition/ The Hacker News https://thehackernews.com/2021/08/microsoft-releases-windows-updates-to.html SecurityWeek https://www.securityweek.com/microsoft-patch-tuesday-windows-flaw-under-active-attack Mitre CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26423 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26424 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26425 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26426 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26428 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26429 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26430 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26431 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26432 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26433 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30590 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30591 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30592 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30593 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30594 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30596 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30597 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33762 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34471 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34478 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34480 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34483 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34484 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34485 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34486 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34487 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34524 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34530 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34532 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34533 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34534 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34535 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34536 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34537 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36926 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36927 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36932 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36933 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36936 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36937 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36938 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36940 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36941 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36942 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36945 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36946 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36947 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36948 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36949 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36950 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCYROLhAAKCRDBnEyTZRJg QoPcAJ92RWAXqFVA7K+qkHYQY2+eXjeCIQCeI5pKK0C7TMwRrma7M7Yfuyzg9mc= =/yiH -----END PGP SIGNATURE-----