KLA12140 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges.

Below is a complete list of vulnerabilities:

1. An unsigned code execution vulnerability in Azure Sphere can be exploited remotely to execute arbitrary code.
2. An elevation of privilege vulnerability in Azure ms-rest-nodeauth Library can be exploited remotely to gain privileges.

Original advisories

CVE-2021-28460

CVE-2021-28458

Related products

Microsoft-Azure

CVE list

CVE-2021-28460 critical

CVE-2021-28458 critical

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• @azure/ms-rest-nodeauthAzure Sphere