...
Прошёл второй вторник ноября 2022-го, а это значит, что корпорация из Редмонда традиционно подготовила патчи. В этот раз разработчики разобрались с 68 уязвимостями, шесть их которых эксплуатируются в кибератаках.
11 проблем получили статус критических, с их помощью атакующие могут повысить права в системе, провести спуфинг или удалённо выполнить код. По типам уязвимости распределились следующим образом:
- 27 багов, приводящих к повышению привилегий;
- 4 — обход защитных функций;
- 16 — удалённое выполнение кода;
- 11 — раскрытие информации;
- 6 — DoS;
- 3 — спуфинг.
Теперь поговорим подробнее про 0-day, которые уже используются в реальных кибератаках. Согласно опубликованной Microsoft информации, уязвимости нулевого дня получили следующие идентификаторы:
- CVE-2022-41128 — возможность удалённого выполнения кода в скриптовых языках Windows.
- CVE-2022-41091 — обход защитной функциональности Mark of the Web.
- CVE-2022-41073 — возможность повышения привилегий в спулере печати Microsoft Windows.
- CVE-2022-41125 — повышение прав в службе Windows CNG Key Isolation.
- CVE-2022-41040 — повышение прав в Microsoft Exchange Server.
- CVE-2022-41082 — удалённое выполнение кода в Microsoft Exchange Server.
Полный список устранённых проблем с идентификаторами и степенью риска публикуем в виде таблицы:
| Tag | CVE-идентификатор | CVE-наименование | Уровень опасности |
|---|---|---|---|
| .NET Framework | CVE-2022-41064 | .NET Framework Information Disclosure Vulnerability | Важная |
| AMD CPU Branch | CVE-2022-23824 | AMD: CVE-2022-23824 IBPB and Return Address Predictor Interactions | Важная |
| Azure | CVE-2022-39327 | GitHub: CVE-2022-39327 Improper Control of Generation of Code ('Code Injection') in Azure CLI | Критическая |
| Azure | CVE-2022-41085 | Azure CycleCloud Elevation of Privilege Vulnerability | Важная |
| Azure Real Time Operating System | CVE-2022-41051 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | Важная |
| Linux Kernel | CVE-2022-38014 | Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability | Важная |
| Microsoft Dynamics | CVE-2022-41066 | Microsoft Business Central Information Disclosure Vulnerability | Важная |
| Microsoft Exchange Server | CVE-2022-41040 | Microsoft Exchange Information Disclosure Vulnerability | Критическая |
| Microsoft Exchange Server | CVE-2022-41082 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Важная |
| Microsoft Exchange Server | CVE-2022-41078 | Microsoft Exchange Server Spoofing Vulnerability | Важная |
| Microsoft Exchange Server | CVE-2022-41080 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Критическая |
| Microsoft Exchange Server | CVE-2022-41079 | Microsoft Exchange Server Spoofing Vulnerability | Важная |
| Microsoft Exchange Server | CVE-2022-41123 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Важная |
| Microsoft Graphics Component | CVE-2022-41113 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | Важная |
| Microsoft Graphics Component | CVE-2022-41052 | Windows Graphics Component Remote Code Execution Vulnerability | Важная |
| Microsoft Office | ADV220003 | Microsoft Defense in Depth Update | Важная |
| Microsoft Office | CVE-2022-41105 | Microsoft Excel Information Disclosure Vulnerability | Важная |
| Microsoft Office | CVE-2022-41107 | Microsoft Office Graphics Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2022-41104 | Microsoft Excel Security Feature Bypass Vulnerability | Важная |
| Microsoft Office Excel | CVE-2022-41063 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2022-41106 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office SharePoint | CVE-2022-41122 | Microsoft SharePoint Server Spoofing Vulnerability | Важная |
| Microsoft Office SharePoint | CVE-2022-41062 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Важная |
| Microsoft Office Word | CVE-2022-41103 | Microsoft Word Information Disclosure Vulnerability | Важная |
| Microsoft Office Word | CVE-2022-41061 | Microsoft Word Remote Code Execution Vulnerability | Важная |
| Microsoft Office Word | CVE-2022-41060 | Microsoft Word Information Disclosure Vulnerability | Важная |
| Network Policy Server (NPS) | CVE-2022-41056 | Network Policy Server (NPS) RADIUS Protocol Denial of Service Vulnerability | Важная |
| Network Policy Server (NPS) | CVE-2022-41097 | Network Policy Server (NPS) RADIUS Protocol Information Disclosure Vulnerability | Важная |
| Open Source Software | CVE-2022-3786 | OpenSSL: CVE-2022-3786 X.509 certificate verification buffer overrun | Unknown |
| Open Source Software | CVE-2022-3602 | OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun | Unknown |
| Role: Windows Hyper-V | CVE-2022-38015 | Windows Hyper-V Denial of Service Vulnerability | Критическая |
| SysInternals | CVE-2022-41120 | Microsoft Windows Sysmon Elevation of Privilege Vulnerability | Важная |
| Visual Studio | CVE-2022-39253 | GitHub: CVE-2022-39253 Local clone optimization dereferences symbolic links by default | Важная |
| Visual Studio | CVE-2022-41119 | Visual Studio Remote Code Execution Vulnerability | Важная |
| Windows Advanced Local Procedure Call | CVE-2022-41093 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Важная |
| Windows ALPC | CVE-2022-41045 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Важная |
| Windows ALPC | CVE-2022-41100 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Важная |
| Windows Bind Filter Driver | CVE-2022-41114 | Windows Bind Filter Driver Elevation of Privilege Vulnerability | Важная |
| Windows BitLocker | CVE-2022-41099 | BitLocker Security Feature Bypass Vulnerability | Важная |
| Windows CNG Key Isolation Service | CVE-2022-41125 | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | Важная |
| Windows Devices Human Interface | CVE-2022-41055 | Windows Human Interface Device Information Disclosure Vulnerability | Важная |
| Windows Digital Media | CVE-2022-41095 | Windows Digital Media Receiver Elevation of Privilege Vulnerability | Важная |
| Windows DWM Core Library | CVE-2022-41096 | Microsoft DWM Core Library Elevation of Privilege Vulnerability | Важная |
| Windows Extensible File Allocation | CVE-2022-41050 | Windows Extensible File Allocation Table Elevation of Privilege Vulnerability | Важная |
| Windows Group Policy Preference Client | CVE-2022-37992 | Windows Group Policy Elevation of Privilege Vulnerability | Важная |
| Windows Group Policy Preference Client | CVE-2022-41086 | Windows Group Policy Elevation of Privilege Vulnerability | Важная |
| Windows HTTP.sys | CVE-2022-41057 | Windows HTTP.sys Elevation of Privilege Vulnerability | Важная |
| Windows Kerberos | CVE-2022-37967 | Windows Kerberos Elevation of Privilege Vulnerability | Критическая |
| Windows Kerberos | CVE-2022-41053 | Windows Kerberos Denial of Service Vulnerability | Важная |
| Windows Kerberos | CVE-2022-37966 | Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability | Критическая |
| Windows Mark of the Web (MOTW) | CVE-2022-41049 | Windows Mark of the Web Security Feature Bypass Vulnerability | Важная |
| Windows Mark of the Web (MOTW) | CVE-2022-41091 | Windows Mark of the Web Security Feature Bypass Vulnerability | Важная |
| Windows Netlogon | CVE-2022-38023 | Netlogon RPC Elevation of Privilege Vulnerability | Важная |
| Windows Network Address Translation (NAT) | CVE-2022-41058 | Windows Network Address Translation (NAT) Denial of Service Vulnerability | Важная |
| Windows ODBC Driver | CVE-2022-41047 | Microsoft ODBC Driver Remote Code Execution Vulnerability | Важная |
| Windows ODBC Driver | CVE-2022-41048 | Microsoft ODBC Driver Remote Code Execution Vulnerability | Важная |
| Windows Overlay Filter | CVE-2022-41101 | Windows Overlay Filter Elevation of Privilege Vulnerability | Важная |
| Windows Overlay Filter | CVE-2022-41102 | Windows Overlay Filter Elevation of Privilege Vulnerability | Важная |
| Windows Point-to-Point Tunneling Protocol | CVE-2022-41044 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | Критическая |
| Windows Point-to-Point Tunneling Protocol | CVE-2022-41116 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability | Важная |
| Windows Point-to-Point Tunneling Protocol | CVE-2022-41090 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability | Важная |
| Windows Point-to-Point Tunneling Protocol | CVE-2022-41039 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | Критическая |
| Windows Point-to-Point Tunneling Protocol | CVE-2022-41088 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | Критическая |
| Windows Print Spooler Components | CVE-2022-41073 | Windows Print Spooler Elevation of Privilege Vulnerability | Важная |
| Windows Resilient File System (ReFS) | CVE-2022-41054 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | Важная |
| Windows Scripting | CVE-2022-41118 | Windows Scripting Languages Remote Code Execution Vulnerability | Критическая |
| Windows Scripting | CVE-2022-41128 | Windows Scripting Languages Remote Code Execution Vulnerability | Критическая |
| Windows Win32K | CVE-2022-41092 | Windows Win32k Elevation of Privilege Vulnerability | Важная |
| Windows Win32K | CVE-2022-41109 | Windows Win32k Elevation of Privilege Vulnerability | Важная |
| Windows Win32K | CVE-2022-41098 | Windows GDI+ Information Disclosure Vulnerability | Важная |
