پشتیبانی 24/7 :

031-36691964 | 021-88203003

جستجو

مایکروسافت وصله های امنیتی سه شنبه های ماه February 2023 را منتشر کرد.

تیتر مطالب

مایکروسافت به روز رسانی این ماه خود را منتشر کرد و 3 آسیب پذیری Zero-day فعال و جمعا 77 حفره امنیتی را برطرف کرد.

9 آسیب پذیری از این 77 مورد در دسته آسیب پذیری های حیاتی قرار میگیرند و بهره برداری از آنها امکان اجرای کد از راه دور را به مهاجم میدهد.
تعداد آسیب پذیری های موجود در هر دسته بندی به صورت زیر می باشد:

• 12 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 38 Remote Code Execution Vulnerabilities
• 8 Information Disclosure Vulnerabilities
• 10 Denial of Service Vulnerabilities
• 8 Spoofing Vulnerabilities

سه آسیب پذیری Zero-day

در وصله های امنیتی این ماه سه آسیب پذیری zero-day که به صورت فعال در حملات استفاده شده است، نیز رفع شده است:

CVE-2023-21823– Windows Graphics Component Remote Code Execution Vulnerability

این آسیب پذیری به مهاجم اجازه اجرای دستورات با دسترسی های SYSTEM را میدهد.
این آپدیت امنیتی باید توسط کاربر از طریق Microsoft Store دریافت شود. بنابراین آن دسته از کاربرانی که آپدیت خودکار در Microsoft Store را غیرفعال کرده اند، به صورت خودکار این آپدیت را دریافت نخواهند کرد.

CVE-2023-21715– Microsoft Publisher Security Features Bypass Vulnerability

دومین آسیب پذیری Zero-day در Microsoft Publisher بوده و امکان دور زدن پالیسی های ماکرو Office که فایل های مخرب و غیرقابل اعتماد را بلاک می کند، میدهد. با بهره گیری از این آسیب پذیری می توان مستندات Publisher مخرب را بدون هیچ هشداری به کاربر، اجرا کرد.

CVE-2023-23376 -Windows Common Log File System Driver Elevation of Privilege Vulnerability

سومین آسیب پذیری مورد بهره برداری قرار گرفته به مهاجم امکان دسترسی به امتیازات SYSTEM را میدهد.

آپدیت های منتشر شده در این ماه توسط سایر شرکتها

 Adobe released security updates for numerous products.
Apple fixed an actively exploited WebKit zero-day vulnerability in iOS and MacOS.
Atlassian released security updates for a critical Jira Service Management Server and Data Center vulnerability.
Cisco released security updates for multiple products, including Cisco Identity Services, Cisco Broadworks, and the Cisco Email Security appliance.
Google released the February security updates for Pixel.
Fortra released a security update for the actively exploited GoAnywhere MFT zero-day flaw.
SAP has released its February 2023 Patch Day updates.

لیست کامل وصله های امنیتی این ماه مایکروسافت در جدول زیر قابل مشاهده است:

Tag CVE ID CVE Title Severity
.NET and Visual Studio CVE-2023-21808 .NET and Visual Studio Remote Code Execution Vulnerability Critical
.NET Framework CVE-2023-21722 .NET Framework Denial of Service Vulnerability Important
3D Builder CVE-2023-23390 3D Builder Remote Code Execution Vulnerability Important
3D Builder CVE-2023-23377 3D Builder Remote Code Execution Vulnerability Important
3D Builder CVE-2023-23378 Print 3D Remote Code Execution Vulnerability Important
Azure App Service CVE-2023-21777 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability Important
Azure Data Box Gateway CVE-2023-21703 Azure Data Box Gateway Remote Code Execution Vulnerability Important
Azure DevOps CVE-2023-21564 Azure DevOps Server Cross-Site Scripting Vulnerability Important
Azure DevOps CVE-2023-21553 Azure DevOps Server Remote Code Execution Vulnerability Important
Azure Machine Learning CVE-2023-23382 Azure Machine Learning Compute Instance Information Disclosure Vulnerability Important
HoloLens CVE-2019-15126 MITRE: CVE-2019-15126 Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device Unknown
Internet Storage Name Service CVE-2023-21699 Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability Important
Internet Storage Name Service CVE-2023-21697 Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability Important
Mariner CVE-2022-43552 Unknown Unknown
Microsoft Defender for Endpoint CVE-2023-21809 Microsoft Defender for Endpoint Security Feature Bypass Vulnerability Important
Microsoft Defender for IoT CVE-2023-23379 Microsoft Defender for IoT Elevation of Privilege Vulnerability Important
Microsoft Dynamics CVE-2023-21807 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important
Microsoft Dynamics CVE-2023-21573 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important
Microsoft Dynamics CVE-2023-21571 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important
Microsoft Dynamics CVE-2023-21572 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important
Microsoft Dynamics CVE-2023-21778 Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability Important
Microsoft Dynamics CVE-2023-21570 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important
Microsoft Edge (Chromium-based) CVE-2023-23374 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Moderate
Microsoft Edge (Chromium-based) CVE-2023-21794 Microsoft Edge (Chromium-based) Spoofing Vulnerability Low
Microsoft Edge (Chromium-based) CVE-2023-21720 Microsoft Edge (Chromium-based) Tampering Vulnerability Low
Microsoft Exchange Server CVE-2023-21710 Microsoft Exchange Server Remote Code Execution Vulnerability Important
Microsoft Exchange Server CVE-2023-21707 Microsoft Exchange Server Remote Code Execution Vulnerability Important
Microsoft Exchange Server CVE-2023-21706 Microsoft Exchange Server Remote Code Execution Vulnerability Important
Microsoft Exchange Server CVE-2023-21529 Microsoft Exchange Server Remote Code Execution Vulnerability Important
Microsoft Graphics Component CVE-2023-21804 Windows Graphics Component Elevation of Privilege Vulnerability Important
Microsoft Graphics Component CVE-2023-21823 Windows Graphics Component Remote Code Execution Vulnerability Important
Microsoft Office CVE-2023-21714 Microsoft Office Information Disclosure Vulnerability Important
Microsoft Office OneNote CVE-2023-21721 Microsoft OneNote Spoofing Vulnerability Important
Microsoft Office Publisher CVE-2023-21715 Microsoft Publisher Security Features Bypass Vulnerability Important
Microsoft Office SharePoint CVE-2023-21717 Microsoft SharePoint Server Elevation of Privilege Vulnerability Important
Microsoft Office Word CVE-2023-21716 Microsoft Word Remote Code Execution Vulnerability Critical
Microsoft PostScript Printer Driver CVE-2023-21693 Microsoft PostScript Printer Driver Information Disclosure Vulnerability Important
Microsoft PostScript Printer Driver CVE-2023-21801 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability Important
Microsoft PostScript Printer Driver CVE-2023-21684 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability Important
Microsoft WDAC OLE DB provider for SQL CVE-2023-21686 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Important
Microsoft WDAC OLE DB provider for SQL CVE-2023-21685 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Important
Microsoft WDAC OLE DB provider for SQL CVE-2023-21799 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2023-21802 Windows Media Remote Code Execution Vulnerability Important
Power BI CVE-2023-21806 Power BI Report Server Spoofing Vulnerability Important
SQL Server CVE-2023-21713 Microsoft SQL Server Remote Code Execution Vulnerability Important
SQL Server CVE-2023-21718 Microsoft SQL ODBC Driver Remote Code Execution Vulnerability Critical
SQL Server CVE-2023-21528 Microsoft SQL Server Remote Code Execution Vulnerability Important
SQL Server CVE-2023-21705 Microsoft SQL Server Remote Code Execution Vulnerability Important
SQL Server CVE-2023-21568 Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability Important
SQL Server CVE-2023-21704 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Important
Visual Studio CVE-2023-21566 Visual Studio Elevation of Privilege Vulnerability Important
Visual Studio CVE-2023-21815 Visual Studio Remote Code Execution Vulnerability Critical
Visual Studio CVE-2023-23381 Visual Studio Remote Code Execution Vulnerability Critical
Visual Studio CVE-2023-21567 Visual Studio Denial of Service Vulnerability Important
Windows Active Directory CVE-2023-21816 Windows Active Directory Domain Services API Denial of Service Vulnerability Important
Windows ALPC CVE-2023-21688 NT OS Kernel Elevation of Privilege Vulnerability Important
Windows Common Log File System Driver CVE-2023-23376 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important
Windows Common Log File System Driver CVE-2023-21812 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important
Windows Cryptographic Services CVE-2023-21813 Windows Secure Channel Denial of Service Vulnerability Important
Windows Cryptographic Services CVE-2023-21819 Windows Secure Channel Denial of Service Vulnerability Important
Windows Distributed File System (DFS) CVE-2023-21820 Windows Distributed File System (DFS) Remote Code Execution Vulnerability Important
Windows Fax and Scan Service CVE-2023-21694 Windows Fax Service Remote Code Execution Vulnerability Important
Windows HTTP.sys CVE-2023-21687 HTTP.sys Information Disclosure Vulnerability Important
Windows Installer CVE-2023-21800 Windows Installer Elevation of Privilege Vulnerability Important
Windows iSCSI CVE-2023-21803 Windows iSCSI Discovery Service Remote Code Execution Vulnerability Critical
Windows iSCSI CVE-2023-21700 Windows iSCSI Discovery Service Denial of Service Vulnerability Important
Windows iSCSI CVE-2023-21702 Windows iSCSI Service Denial of Service Vulnerability Important
Windows iSCSI CVE-2023-21811 Windows iSCSI Service Denial of Service Vulnerability Important
Windows Kerberos CVE-2023-21817 Windows Kerberos Elevation of Privilege Vulnerability Important
Windows MSHTML Platform CVE-2023-21805 Windows MSHTML Platform Remote Code Execution Vulnerability Important
Windows ODBC Driver CVE-2023-21797 Microsoft ODBC Driver Remote Code Execution Vulnerability Important
Windows ODBC Driver CVE-2023-21798 Microsoft ODBC Driver Remote Code Execution Vulnerability Important
Windows Protected EAP (PEAP) CVE-2023-21695 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Important
Windows Protected EAP (PEAP) CVE-2023-21701 Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service Vulnerability Important
Windows Protected EAP (PEAP) CVE-2023-21692 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Critical
Windows Protected EAP (PEAP) CVE-2023-21691 Microsoft Protected Extensible Authentication Protocol (PEAP) Information Disclosure Vulnerability Important
Windows Protected EAP (PEAP) CVE-2023-21690 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Critical
Windows Protected EAP (PEAP) CVE-2023-21689 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Critical
Windows SChannel CVE-2023-21818 Windows Secure Channel Denial of Service Vulnerability Important
Windows Win32K CVE-2023-21822 Windows Graphics Component Elevation of Privilege Vulnerability Important

 

منبع: https://www.bleepingcomputer.com/