10 noviembre, 2021

9VSA21-00519-01 CSIRT alerta de vulnerabilidades del Update Tuesday de Microsoft en Noviembre 2021

Resumen

El Equipo de Respuesta ante Incidentes de Seguridad Informática del Gobierno de Chile, CSIRT de Gobierno, comparte información sobre nuevas vulnerabilidades comunicadas por Microsoft para sus productos como parte de su Update Tuesday de noviembre.

Este informe incluye las medidas de mitigación, consistentes en instalar la última actualización de los productos afectados.

Vulnerabilidades

CVE-2021-42298
CVE-2021-42279
CVE-2021-42316
CVE-2021-26443
CVE-2021-3711
CVE-2021-38666
CVE-2021-41351
CVE-2021-43209
CVE-2021-43208
CVE-2021-26444
CVE-2021-42323
CVE-2021-42322
CVE-2021-42321
CVE-2021-42319
CVE-2021-41376
CVE-2021-41374
CVE-2021-42304
CVE-2021-42303
CVE-2021-42302
CVE-2021-42301
CVE-2021-42300
CVE-2021-42305
CVE-2021-42277
CVE-2021-42296
CVE-2021-42291
CVE-2021-42287
CVE-2021-42288
CVE-2021-42285
CVE-2021-42284
CVE-2021-42283
CVE-2021-42282
CVE-2021-42278
CVE-2021-42275
CVE-2021-42274
CVE-2021-41373
CVE-2021-41375
CVE-2021-41372
CVE-2021-41368
CVE-2021-41367
CVE-2021-40442
CVE-2021-38631
CVE-2021-38665
CVE-2021-42292
CVE-2021-42286
CVE-2021-42276
CVE-2021-41379
CVE-2021-41377
CVE-2021-41378
CVE-2021-41371
CVE-2021-41370
CVE-2021-41366
CVE-2021-41349
CVE-2021-41356
CVE-2021-36957
CVE-2021-42280

Impactos

Vulnerabilidades críticas

CVE-2021-42298: Vulnerabilidad de ejecución remota de código en Microsoft Defender. El ataque podría detonar el exploit sin requerir acción alguna de la víctima.

CVE-2021-42279: Vulnerabilidad de corrupción de memoria en el Chakra Scripting Engine.

CVE-2021-42316: Vulnerabilidad de ejecución remota de código en Microsoft Dynamics 365 (on-premises).

CVE-2021-26443: Vulnerabilidad de ejecución remota de código en Microsoft Virtual Machine Bus (VMBus).

CVE-2021-3711: Vulnerabilidad de desbordamiento de buffer en Open SSL.

CVE-2021-38666: Vulnerabilidad de ejecución remota de código en un cliente Remote Desktop. Un ataque con control de un servidor Remote Desktop podría detonar la ejecución remota de código en una máquina cliente Remote Desktop cuando la víctima se conecte al servidor.

Vulnerabilidades importantes

CVE-2021-41351
CVE-2021-43209
CVE-2021-43208
CVE-2021-26444
CVE-2021-42323
CVE-2021-42322
CVE-2021-42321
CVE-2021-42319
CVE-2021-41376
CVE-2021-41374
CVE-2021-42304
CVE-2021-42303
CVE-2021-42302
CVE-2021-42301
CVE-2021-42300
CVE-2021-42305
CVE-2021-42277
CVE-2021-42296
CVE-2021-42291
CVE-2021-42287
CVE-2021-42288
CVE-2021-42285
CVE-2021-42284
CVE-2021-42283
CVE-2021-42282
CVE-2021-42278
CVE-2021-42275
CVE-2021-42274
CVE-2021-41373
CVE-2021-41375
CVE-2021-41372
CVE-2021-41368
CVE-2021-41367
CVE-2021-40442
CVE-2021-38631
CVE-2021-38665
CVE-2021-42292
CVE-2021-42286
CVE-2021-42276
CVE-2021-41379
CVE-2021-41377
CVE-2021-41378
CVE-2021-41371
CVE-2021-41370
CVE-2021-41366
CVE-2021-41349
CVE-2021-41356
CVE-2021-36957
CVE-2021-42280

Productos Afectados

3D Viewer
Azure RTOS
Azure Sphere
FSLogix
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft Dynamics 365 (on-premises) version 9.1
Microsoft Edge (Chromium-based) in IE Mode
Microsoft Excel 2013 RT Service Pack 1
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2016 Cumulative Update 21
Microsoft Exchange Server 2016 Cumulative Update 22
Microsoft Exchange Server 2019 Cumulative Update 10
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Malware Protection Engine
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Microsoft Office 2019 for Mac
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft Office LTSC for Mac 2021
Microsoft Office Online Server
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Visual Studio 2015 Update 3
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 – 15.8)
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 – 16.10)
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 – 16.8)
Power BI Report Server
Remote Desktop client for Windows Desktop
Visual Studio Code
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 2004 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)

Mitigación

Instalar las respectivas actualizaciones entregadas por el proveedor.

Enlaces
https://msrc.microsoft.com/update-guide/releaseNote/2021-Nov
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42298
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26443
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42316
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42279
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-3711
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38666
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41351
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43209
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43208
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26444
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42323
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42322
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42319
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41376
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41374
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42304
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42303
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42302
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42301
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42300
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42305
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42277
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42296
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42291
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42287
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42288
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42284
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42283
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42282
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42278
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42275
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42274
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41373
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41375
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41372
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41372
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41367
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40442
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38631
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38665
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42292
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42276
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41379
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41377
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41378
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41371
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41370
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41366
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41349
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41356
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36957
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42280

Informe:

El informe oficial publicado por el CSIRT del Gobierno de Chile está disponible en el siguiente enlace: 9VSA21-00519-01.

9VSA21-00519-01 CSIRT alerta de vulnerabilidades del Update Tuesday de Microsoft en Noviembre 2021