Consorzio Metis

CSIRT Toscana

CSIRT Toscana

Aggiornamenti Mensili Microsoft (AL01/241009/CSIRT-ITA) – Aggiornamento

Data:
14 Ottobre 2024 11:11

Data di creazione: 09/10/2024 – 09:29

Sintesi

Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 120 nuove vulnerabilità, di cui 5 di tipo 0-day.

Note: il vendor afferma che degli exploit per le vulnerabilità CVE-2024-43573, CVE-2024-6197, CVE-2024-20659, CVE-2024-43572 e CVE-2024-43583 risultano disponibili in rete.

Note: il vendor afferma che le CVE-2024-43573 e  CVE-2024-43572 risultano essere sfruttate attivamente in rete.

Note (aggiornamento del 14/10/2024): un Proof of Concept (PoC) per lo sfruttamento della CVE-2024-43582 risulta disponibile in rete.

Rischio

Stima d’impatto della vulnerabilità sulla comunità di riferimento: GRAVE/ROSSO (76,66/100)1.

Tipologia

  • Tampering
  • Spoofing
  • Denial of Service
  • Remote Code Execution
  • Security Feature Bypass
  • Information Disclosure
  • Elevation of Privilege

Prodotti e versioni affette

  • .NET, .NET Framework, Visual Studio
  • Azure CLI
  • Azure Monitor
  • Azure Stack
  • BranchCache
  • Code Integrity Guard
  • DeepSpeed
  • Internet Small Computer Systems Interface (iSCSI)
  • Microsoft ActiveX
  • Microsoft Configuration Manager
  • Microsoft Defender for Endpoint
  • Microsoft Graphics Component
  • Microsoft Management Console
  • Microsoft Office
  • Microsoft Office Excel
  • Microsoft Office SharePoint
  • Microsoft Office Visio
  • Microsoft Simple Certificate Enrollment Protocol
  • Microsoft WDAC OLE DB provider for SQL
  • Microsoft Windows Speech
  • OpenSSH for Windows
  • Outlook for Android
  • Power BI
  • Remote Desktop Client
  • RPC Endpoint Mapper Service
  • Service Fabric
  • Sudo for Windows
  • Visual C++ Redistributable Installer
  • Visual Studio
  • Visual Studio Code
  • Windows Ancillary Function Driver for WinSock
  • Windows BitLocker
  • Windows Common Log File System Driver
  • Windows Cryptographic Services
  • Windows EFI Partition
  • Windows Hyper-V
  • Windows Kerberos
  • Windows Kernel
  • Windows Kernel-Mode Drivers
  • Windows Local Security Authority (LSA)
  • Windows Mobile Broadband
  • Windows MSHTML Platform
  • Windows Netlogon
  • Windows Network Address Translation (NAT)
  • Windows NT OS Kernel
  • Windows NTFS
  • Windows Online Certificate Status Protocol (OCSP)
  • Windows Print Spooler Components
  • Windows Remote Desktop
  • Windows Remote Desktop Licensing Service
  • Windows Remote Desktop Services
  • Windows Resilient File System (ReFS)
  • Windows Routing and Remote Access Service (RRAS)
  • Windows Scripting
  • Windows Secure Channel
  • Windows Secure Kernel Mode
  • Windows Shell
  • Windows Standards-Based Storage Management Service
  • Windows Storage
  • Windows Storage Port Driver
  • Windows Telephony Server
  • Winlogon

Azioni di mitigazione

In linea con le dichiarazioni del vendor, si raccomanda di procedere all’aggiornamento dei prodotti impattati attraverso l’apposita funzione di Windows Update.

Identificatori univoci vulnerabilità

CVE-ID
CVE-2024-43543 CVE-2024-43546 CVE-2024-43456 CVE-2024-43483
CVE-2024-37983 CVE-2024-43564 CVE-2024-38212 CVE-2024-43575
CVE-2024-43521 CVE-2024-43612 CVE-2024-43523 CVE-2024-43535
CVE-2024-38265 CVE-2024-43582 CVE-2024-43506 CVE-2024-43589
CVE-2024-43583 CVE-2024-43574 CVE-2024-43497 CVE-2024-43503
CVE-2024-43513 CVE-2024-43611 CVE-2024-43488 CVE-2024-43552
CVE-2024-43570 CVE-2024-43526 CVE-2024-43511 CVE-2024-43553
CVE-2024-43590 CVE-2024-43537 CVE-2024-43545 CVE-2024-43508
CVE-2024-43556 CVE-2024-38149 CVE-2024-43547 CVE-2024-43593
CVE-2024-43524 CVE-2024-43516 CVE-2024-43554 CVE-2024-43544
CVE-2024-43485 CVE-2024-43533 CVE-2024-43522 CVE-2024-43542
CVE-2024-43615 CVE-2024-43551 CVE-2024-43555 CVE-2024-27397
CVE-2024-43536 CVE-2024-43608 CVE-2024-43614 CVE-2024-43515
CVE-2024-38262 CVE-2024-43541 CVE-2024-43581 CVE-2024-43565
CVE-2024-43601 CVE-2024-43609 CVE-2024-43481 CVE-2024-37976
CVE-2024-43576 CVE-2024-38179 CVE-2024-30092 CVE-2024-43529
CVE-2024-43520 CVE-2024-43512 CVE-2024-38097 CVE-2024-43538
CVE-2024-43567 CVE-2024-43504 CVE-2024-38229 CVE-2024-43572
CVE-2024-43484 CVE-2024-38124 CVE-2024-6197 CVE-2024-43591
CVE-2024-43500 CVE-2024-37982 CVE-2024-43532 CVE-2024-43519
CVE-2024-43525 CVE-2024-20659 CVE-2024-43550 CVE-2024-43610
CVE-2024-43573 CVE-2024-43518 CVE-2024-43480 CVE-2024-43604
CVE-2024-43514 CVE-2024-43561 CVE-2024-43502 CVE-2024-38261
CVE-2024-43562 CVE-2024-43468 CVE-2024-43549 CVE-2024-43557
CVE-2024-37979 CVE-2024-43509 CVE-2024-43540 CVE-2024-43603
CVE-2024-43528 CVE-2024-43571 CVE-2024-43560 CVE-2024-43517
CVE-2024-43558 CVE-2024-43616 CVE-2024-43563 CVE-2024-43585
CVE-2024-43534 CVE-2024-43453 CVE-2024-43584 CVE-2024-43501
CVE-2024-43505 CVE-2024-43527 CVE-2024-43559 CVE-2024-38029
CVE-2024-43599 CVE-2024-43607 CVE-2024-43592 CVE-2024-38129

Riferimenti

https://msrc.microsoft.com/update-guide/releaseNote/2024-Oct

https://msrc.microsoft.com/update-guide (NB: filtro: patch tuesday – October 2024)

1La presente stima è effettuata tenendo conto di diversi parametri, tra i quali: CVSS, disponibilità di patch/workaround e PoC, diffusione dei software/dispositivi interessati nella comunità di riferimento.

Il presente articolo è un prodotto originale di csirt.gov.it, riproposto qui a solo scopo di aumentarne la visibilità.