بروزرسانی امنیتی سه شنبه ماه مارس 2022مایکروسافت (سه آسیب پذیری روز صفر و در مجموع 71 نقص را برطرف می کند.)

 March2


امروز بروزرسانی سه‌شنبه مارس ۲۰۲۲ مایکروسافت منتشر شد و در این فهرست سه آسیب‌پذیری Zero-day و در مجموع 71 نقص امنیتی برطرف شده است.
در این بروزرسانی مایکروسافت 71 آسیب پذیری (بدون احتساب 21 آسیب پذیری Microsoft Edge ) که سه آسیب پذیری از این فهرست به علت امکان اجرای کد از راه دور  به عنوان بحرانی طبقه بندی شده را برطرف کرده است.


تعداد هر نوع آسیب پذیری شامل:


•    25 آسیب پذیری Elevation of Privilege
•    3 آسیب پذیری Security Feature Bypass
•    29 آسیب پذیری Remote Code Execution
•    6 آسیب پذیری Information Disclosure
•    4 آسیب پذیری Denial of Service
•    3 آسیب پذیری Spoofing
•    21 آسیب پذیری Edge – Chromium


سه آسیب پذیری Zero-day برطرف شد که به طور فعال مورد سوء استفاده قرار نگرفته است.


بروزرسانی سه شنبه این ماه شامل رفع سه آسیب‌پذیری Zero-day  است که به طور عمومی فاش شده‌. خبر خوب اینکه، این آسیب پذیری ها به طور فعال در حملات مورد سوء استفاده قرار نگرفتند.
مایکروسافت آسیب‌پذیری های دیگری که به‌صورت عمومی فاش شده به عنوان بخشی از بروزرسانی سه شنبه مارس 2022 برطرف کرد:
•    آسیب پذیری CVE-2022-21990 - Remote Desktop Client Remote Code Execution
•    آسیب پذیری CVE-2022-24459 - Windows Fax and Scan Service Elevation of Privilege
•    آسیب پذیری CVE-2022-24512 - .NET and Visual Studio Remote Code Execution


سایر آسیب پذیری هایی که در این ماه بیشتر مورد هدف مهاجمان بوده است:


•    آسیب پذیری CVE-2022-24508 - Windows SMBv3 Client/Server Remote Code Execution
•    آسیب پذیریCVE-2022-23277 - Microsoft Exchange Server Remote Code Execution


بروز رسانی های اخیر از سایر شرکت ها: سایر شرکت هایی که در ماه مارس بروزرسانی هایی را منتشر کردند عبارتند از:


•    گوگل بروزرسانی‌های امنیتی ماه مارس اندروید را منتشر کرد.
•    سیسکو بروزرسانی‌های امنیتی را برای محصولات متعددی ، از جمله Cisco Cisco FXOS و NX-OS، StarOS، و Cisco Application Policy Infrastructure Controller منتشر کرد.
•    HP 16 آسیب‌پذیری میان‌افزار UEFI را فاش کرد که مهاجمان می‌توانند از آنها برای نصب بدافزار مخفی استفاده کنند.


بروزرسانی‌های امنیتی سه‌شنبه مارس 2022:

لیست کامل این بروز رسانی ها در جدول زیر قابل مشاهده می باشد:

TagCVE IDCVE TitleSeverity
.NET and Visual Studio CVE-2022-24512 .NET and Visual Studio Remote Code Execution Vulnerability Important
.NET and Visual Studio CVE-2022-24464 .NET and Visual Studio Denial of Service Vulnerability Important
.NET and Visual Studio CVE-2020-8927 Brotli Library Buffer Overflow Vulnerability Important
Azure Site Recovery CVE-2022-24506 Azure Site Recovery Elevation of Privilege Vulnerability Important
Azure Site Recovery CVE-2022-24517 Azure Site Recovery Remote Code Execution Vulnerability Important
Azure Site Recovery CVE-2022-24470 Azure Site Recovery Remote Code Execution Vulnerability Important
Azure Site Recovery CVE-2022-24471 Azure Site Recovery Remote Code Execution Vulnerability Important
Azure Site Recovery CVE-2022-24520 Azure Site Recovery Remote Code Execution Vulnerability Important
Azure Site Recovery CVE-2022-24518 Azure Site Recovery Elevation of Privilege Vulnerability Important
Azure Site Recovery CVE-2022-24519 Azure Site Recovery Elevation of Privilege Vulnerability Important
Azure Site Recovery CVE-2022-24515 Azure Site Recovery Elevation of Privilege Vulnerability Important
Azure Site Recovery CVE-2022-24467 Azure Site Recovery Remote Code Execution Vulnerability Important
Azure Site Recovery CVE-2022-24468 Azure Site Recovery Remote Code Execution Vulnerability Important
Azure Site Recovery CVE-2022-24469 Azure Site Recovery Elevation of Privilege Vulnerability Important
Microsoft Defender for Endpoint CVE-2022-23278 Microsoft Defender for Endpoint Spoofing Vulnerability Important
Microsoft Defender for IoT CVE-2022-23265 Microsoft Defender for IoT Remote Code Execution Vulnerability Important
Microsoft Defender for IoT CVE-2022-23266 Microsoft Defender for IoT Elevation of Privilege Vulnerability Important
Microsoft Edge (Chromium-based) CVE-2022-0790 Chromium: CVE-2022-0790 Use after free in Cast UI Unknown
Microsoft Edge (Chromium-based) CVE-2022-0789 Chromium: CVE-2022-0789 Heap buffer overflow in ANGLE Unknown
Microsoft Edge (Chromium-based) CVE-2022-0809 Chromium: CVE-2022-0809 Out of bounds memory access in WebXR Unknown
Microsoft Edge (Chromium-based) CVE-2022-0791 Chromium: CVE-2022-0791 Use after free in Omnibox Unknown
Microsoft Edge (Chromium-based) CVE-2022-0803 Chromium: CVE-2022-0803 Inappropriate implementation in Permissions Unknown
Microsoft Edge (Chromium-based) CVE-2022-0804 Chromium: CVE-2022-0804 Inappropriate implementation in Full screen mode Unknown
Microsoft Edge (Chromium-based) CVE-2022-0801 Chromium: CVE-2022-0801 Inappropriate implementation in HTML parser Unknown
Microsoft Edge (Chromium-based) CVE-2022-0802 Chromium: CVE-2022-0802 Inappropriate implementation in Full screen mode Unknown
Microsoft Edge (Chromium-based) CVE-2022-0807 Chromium: CVE-2022-0807 Inappropriate implementation in Autofill Unknown
Microsoft Edge (Chromium-based) CVE-2022-0808 Chromium: CVE-2022-0808 Use after free in Chrome OS Shell Unknown
Microsoft Edge (Chromium-based) CVE-2022-0805 Chromium: CVE-2022-0805 Use after free in Browser Switcher Unknown
Microsoft Edge (Chromium-based) CVE-2022-0806 Chromium: CVE-2022-0806 Data leak in Canvas Unknown
Microsoft Edge (Chromium-based) CVE-2022-0800 Chromium: CVE-2022-0800 Heap buffer overflow in Cast UI Unknown
Microsoft Edge (Chromium-based) CVE-2022-0794 Chromium: CVE-2022-0794 Use after free in WebShare Unknown
Microsoft Edge (Chromium-based) CVE-2022-0795 Chromium: CVE-2022-0795 Type Confusion in Blink Layout Unknown
Microsoft Edge (Chromium-based) CVE-2022-0792 Chromium: CVE-2022-0792 Out of bounds read in ANGLE Unknown
Microsoft Edge (Chromium-based) CVE-2022-0793 Chromium: CVE-2022-0793 Use after free in Views Unknown
Microsoft Edge (Chromium-based) CVE-2022-0796 Chromium: CVE-2022-0796 Use after free in Media Unknown
Microsoft Edge (Chromium-based) CVE-2022-0798 Chromium: CVE-2022-0798 Use after free in MediaStream Unknown
Microsoft Edge (Chromium-based) CVE-2022-0797 Chromium: CVE-2022-0797 Out of bounds memory access in Mojo Unknown
Microsoft Edge (Chromium-based) CVE-2022-0799 Chromium: CVE-2022-0799 Insufficient policy enforcement in Installer Unknown
Microsoft Exchange Server CVE-2022-23277 Microsoft Exchange Server Remote Code Execution Vulnerability Critical
Microsoft Exchange Server CVE-2022-24463 Microsoft Exchange Server Spoofing Vulnerability Important
Microsoft Intune CVE-2022-24465 Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability Important
Microsoft Office Visio CVE-2022-24510 Microsoft Office Visio Remote Code Execution Vulnerability Important
Microsoft Office Visio CVE-2022-24509 Microsoft Office Visio Remote Code Execution Vulnerability Important
Microsoft Office Visio CVE-2022-24461 Microsoft Office Visio Remote Code Execution Vulnerability Important
Microsoft Office Word CVE-2022-24462 Microsoft Word Security Feature Bypass Vulnerability Important
Microsoft Office Word CVE-2022-24511 Microsoft Office Word Tampering Vulnerability Important
Microsoft Windows ALPC CVE-2022-23287 Windows ALPC Elevation of Privilege Vulnerability Important
Microsoft Windows ALPC CVE-2022-24505 Windows ALPC Elevation of Privilege Vulnerability Important
Microsoft Windows ALPC CVE-2022-23283 Windows ALPC Elevation of Privilege Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-24451 VP9 Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-22007 HEVC Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-22006 HEVC Video Extensions Remote Code Execution Vulnerability Critical
Microsoft Windows Codecs Library CVE-2022-24452 HEVC Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-24453 HEVC Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-24501 VP9 Video Extensions Remote Code Execution Vulnerability Critical
Microsoft Windows Codecs Library CVE-2022-24457 HEIF Image Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-24456 HEVC Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-22010 Media Foundation Information Disclosure Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-21977 Media Foundation Information Disclosure Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-23295 Raw Image Extension Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-23300 Raw Image Extension Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-23301 HEVC Video Extensions Remote Code Execution Vulnerability Important
Paint 3D CVE-2022-23282 Paint 3D Remote Code Execution Vulnerability Important
Role: Windows Hyper-V CVE-2022-21975 Windows Hyper-V Denial of Service Vulnerability Important
Skype Extension for Chrome CVE-2022-24522 Skype Extension for Chrome Information Disclosure Vulnerability Important
Tablet Windows User Interface CVE-2022-24460 Tablet Windows User Interface Application Elevation of Privilege Vulnerability Important
Visual Studio Code CVE-2022-24526 Visual Studio Code Spoofing Vulnerability Important
Windows Ancillary Function Driver for WinSock CVE-2022-24507 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important
Windows CD-ROM Driver CVE-2022-24455 Windows CD-ROM Driver Elevation of Privilege Vulnerability Important
Windows Cloud Files Mini Filter Driver CVE-2022-23286 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important
Windows COM CVE-2022-23290 Windows Inking COM Elevation of Privilege Vulnerability Important
Windows Common Log File System Driver CVE-2022-23281 Windows Common Log File System Driver Information Disclosure Vulnerability Important
Windows DWM Core Library CVE-2022-23291 Windows DWM Core Library Elevation of Privilege Vulnerability Important
Windows DWM Core Library CVE-2022-23288 Windows DWM Core Library Elevation of Privilege Vulnerability Important
Windows Event Tracing CVE-2022-23294 Windows Event Tracing Remote Code Execution Vulnerability Important
Windows Fastfat Driver CVE-2022-23293 Windows Fast FAT File System Driver Elevation of Privilege Vulnerability Important
Windows Fax and Scan Service CVE-2022-24459 Windows Fax and Scan Service Elevation of Privilege Vulnerability Important
Windows HTML Platform CVE-2022-24502 Windows HTML Platforms Security Feature Bypass Vulnerability Important
Windows Installer CVE-2022-23296 Windows Installer Elevation of Privilege Vulnerability Important
Windows Kernel CVE-2022-23297 Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability Important
Windows Kernel CVE-2022-23298 Windows NT OS Kernel Elevation of Privilege Vulnerability Important
Windows Media CVE-2022-21973 Windows Media Center Update Denial of Service Vulnerability Important
Windows PDEV CVE-2022-23299 Windows PDEV Elevation of Privilege Vulnerability Important
Windows Point-to-Point Tunneling Protocol CVE-2022-23253 Point-to-Point Tunneling Protocol Denial of Service Vulnerability Important
Windows Print Spooler Components CVE-2022-23284 Windows Print Spooler Elevation of Privilege Vulnerability Important
Windows Remote Desktop CVE-2022-21990 Remote Desktop Client Remote Code Execution Vulnerability Important
Windows Remote Desktop CVE-2022-23285 Remote Desktop Client Remote Code Execution Vulnerability Important
Windows Remote Desktop CVE-2022-24503 Remote Desktop Protocol Client Information Disclosure Vulnerability Important
Windows Security Support Provider Interface CVE-2022-24454 Windows Security Support Provider Interface Elevation of Privilege Vulnerability Important
Windows SMB Server CVE-2022-24508 Windows SMBv3 Client/Server Remote Code Execution Vulnerability Important
Windows Update Stack CVE-2022-24525 Windows Update Stack Elevation of Privilege Vulnerability Important
XBox CVE-2022-21967 Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability Important


منبع:
https://www.bleepingcomputer.com

افزودن دیدگاه جدید

نظر خودتان را ارسال کنید

کاربر گرامی چنانچه تمایل دارید، نقد یا نظر شما به نام خودتان در سایت ثبت شود، لطفا وارد سایت شوید.

طراحی سایت طراحی سایت طراحی سایت طراحی سایت

کلیه حقوق این سایت محفوظ و متعلق به شرکت مهندسی تحقیق و توسعه ارتباط پانا می باشد.

گفتگوی آنلاین