Alert GCSA-22105 - Microsoft Security Update Settembre 2022
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** Alert ID: GCSA-22105 Data: 14 Settembre 2022 Titolo: Microsoft Security Update Settembre 2022 ****************************************************************** :: Descrizione del problema Microsoft ha rilasciato il security update mensile per Settembre 2022, questa versione risolve 63 vulnerabilita', delle quali due zero-day. NB: la CVE-2022-37969 risulta essere sfruttata attivamente in rete Maggiori dettagli sono disponibili alla sezione "Riferimenti". :: Software interessato .NET and Visual Studio .NET Framework Azure Arc Cache Speculation HTTP.sys Microsoft Dynamics Microsoft Edge (Chromium-based) Microsoft Graphics Component Microsoft Office Microsoft Office SharePoint Microsoft Office Visio Microsoft Windows ALPC Microsoft Windows Codecs Library Network Device Enrollment Service (NDES) Role: DNS Server Role: Windows Fax Service SPNEGO Extended Negotiation Visual Studio Code Windows Common Log File System Driver Windows Credential Roaming Service Windows Defender Windows Distributed File System (DFS) Windows DPAPI (Data Protection Application Programming Interface) Windows Enterprise App Management Windows Event Tracing Windows Group Policy Windows IKE Extension Windows Kerberos Windows Kernel Windows LDAP - Lightweight Directory Access Protocol Windows ODBC Driver Windows OLE Windows Photo Import API Windows Print Spooler Components Windows Remote Access Connection Manager Windows Remote Procedure Call Windows TCP/IP Windows Transport Security Layer (TLS) :: Impatto Esecuzione remota di codice arbitrario (RCE) Denial of Service (DoS) Acquisizione di privilegi piu' elevati (EoP) Information Disclosure (ID) Bypass restrizioni di sicurezza :: Soluzioni Per default l'installazione degli aggiornamenti avviene in maniera automatica. Per installare manualmente scegliere Start > Impostazioni > Aggiornamento e Sicurezza > Windows Update Verificare di aver installato la versione piu' recente del Servicing Stack Updates https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV990001 https://docs.microsoft.com/it-it/windows/deployment/update/servicing-stack-updates Windows Update domande frequenti https://support.microsoft.com/en-us/help/12373/windows-update-faq Gli aggiornamenti sono disponibili anche tramite il catalogo di Microsoft Update https://www.catalog.update.microsoft.com/ Gli utenti che utilizzano ancora Windows 7, Windows Server 2008 o 2008 R2 devono acquistare l'Extended Security Update per continuare a ricevere gli aggiornamenti https://support.microsoft.com/en-hk/help/4522133/procedure-to-continue-receiving-security-updates :: Riferimenti Microsoft Security Updates - Release Notes https://msrc.microsoft.com/update-guide/releaseNote/2022-Sep https://msrc.microsoft.com/update-guide/deployments CSIRT Italia https://www.csirt.gov.it/contenuti/aggiornamenti-mensili-microsoft-al01-220914-csirt-ita CIS - Center for Internet Security https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-13-2022_2022-113 Mitre CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23960 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26928 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26929 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30170 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30196 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30200 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3038 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3039 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3040 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3041 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3044 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3045 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3046 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3047 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3053 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3054 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3055 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3056 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3057 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3058 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3075 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33647 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33679 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34700 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34718 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34719 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34721 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34722 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34723 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34725 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34726 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34727 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34728 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34729 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34730 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34731 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34733 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34734 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35803 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35805 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35823 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35828 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35830 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35831 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35834 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35835 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35836 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35837 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35840 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35841 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37954 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37955 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37956 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37957 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37958 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37959 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37961 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37962 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37963 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37969 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38004 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38005 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38006 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38007 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38008 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38009 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38010 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38011 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38012 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38019 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38020 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEAREIAAYFAmMhlcsACgkQwZxMk2USYEJhIgCgrZ6vi4C2QzP/eAtteHoRfPYq gMMAn2zb9QD+CBZrmQPdODzgMzoZFFu/ =Vaz1 -----END PGP SIGNATURE-----