KLA12568 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products (Extended Security Update). Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, gain privileges, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A denial of service vulnerability in Windows Network Address Translation (NAT) can be exploited remotely to cause denial of service.
2. Information disclosure vulnerability in microarchitectural fill buffers on some Intel Processors can be exploited to obtain sensitive information.
3. An elevation of privilege vulnerability in Windows Advanced Local Procedure Call can be exploited remotely to gain privileges.
4. Information disclosure vulnerability in multi-core shared buffers for some Intel Processors can be exploited to obtain sensitive information.
5. Information disclosure vulnerability in specific special register write operations for some Intel Processors can be exploited to obtain sensitive information.
6. A remote code execution vulnerability in Windows Lightweight Directory Access Protocol (LDAP) can be exploited remotely to execute arbitrary code.
7. An elevation of privilege vulnerability in Windows Ancillary Function Driver for WinSock can be exploited remotely to gain privileges.
8. A remote code execution vulnerability in Windows File History can be exploited remotely to execute arbitrary code.
9. Information disclosure vulnerability in specific special register read operations for some Intel Processors can be exploited to obtain sensitive information.
10. An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges.
11. An elevation of privilege vulnerability in Local Security Authority Subsystem Service can be exploited remotely to gain privileges.
12. A remote code execution vulnerability in Windows Hyper-V can be exploited remotely to execute arbitrary code.
13. A denial of service vulnerability in Windows Kernel can be exploited remotely to cause denial of service.
14. An elevation of privilege vulnerability in Windows Media Center can be exploited remotely to gain privileges.
15. A remote code execution vulnerability in Windows iSCSI Discovery Service can be exploited remotely to execute arbitrary code.

Original advisories

CVE-2022-30152

CVE-2022-21125

CVE-2022-30160

CVE-2022-21123

CVE-2022-21166

CVE-2022-30149

CVE-2022-30151

CVE-2022-30142

CVE-2022-30161

CVE-2022-30146

CVE-2022-21127

CVE-2022-30147

CVE-2022-30166

CVE-2022-30141

CVE-2022-30163

CVE-2022-30155

CVE-2022-30135

CVE-2022-30153

CVE-2022-30143

CVE-2022-30140

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-7

Microsoft-Windows-Server-2008

CVE list

CVE-2022-30152 critical

CVE-2022-21125 high

CVE-2022-30160 critical

CVE-2022-21123 high

CVE-2022-21166 high

CVE-2022-30149 critical

CVE-2022-30151 high

CVE-2022-30142 critical

CVE-2022-30161 critical

CVE-2022-30146 critical

CVE-2022-21127 high

CVE-2022-30147 critical

CVE-2022-30166 critical

CVE-2022-30141 critical

CVE-2022-30163 critical

CVE-2022-30155 high

CVE-2022-30135 critical

CVE-2022-30153 critical

CVE-2022-30143 critical

CVE-2022-30140 critical

KB list

5014742

5014748

5014752

5014743

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Windows Server 2008 for x64-based Systems Service Pack 2Windows 7 for 32-bit Systems Service Pack 1Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2008 R2 for x64-based Systems Service Pack 1Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows 7 for x64-based Systems Service Pack 1Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)