Blog

Microsoft Update: La nueva Actualización de Diciembre parchea más de 60 vulnerabilidades ¡Parchea Ahora!

El día martes 14 de diciembre del presente año, Microsoft anunció y publicó sus nuevas actualizaciones, y con él llegan las mitigaciones para 6 vulnerabilidades de día cero y un total de 67 fallos de seguridad de diferentes prioridades. Estas actualizaciones incluyen la corrección de una vulnerabilidad de Windows Installer, la cual ha sido explotada activamente y utilizada en campañas de distribución de malware por diferentes actores de amenazas.

Microsoft ha corregido 55 vulnerabilidades (sin incluir Microsoft Edge) con la actualización del día martes, solo 7 han sido clasificadas como Críticas y las otras 60 como Importantes.

A continuación se indica el número total de cada tipo de vulnerabilidades lanzadas por Microsoft:

  • 21 Vulnerabilidades de Elevación de Privilegios
  • 26 Vulnerabilidades de Ejecución Remota de Código
  • 10 Vulnerabilidades de divulgación de información
  • 3 Vulnerabilidades de denegación de servicio
  • 7 Vulnerabilidades de suplantación de identidad

¿Cuáles son las vulnerabilidades más críticas de esta actualización?

  • CVE-2021-43215: iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution
  • CVE-2021-42310: Microsoft Defender for IoT Remote Code Execution Vulnerability
  • CVE-2021-43899: Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
  • CVE-2021-43905: Microsoft Office app Remote Code Execution Vulnerability
  • CVE-2021-43233: Remote Desktop Client Remote Code Execution Vulnerability
  • CVE-2021-43908: Visual Studio Code Spoofing Vulnerability
  • CVE-2021-43217: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability

Recomendados a todos los Sysadmins y Administradores de Sistemas, el tomar en cuenta las actualizaciones siguientes e implementarlas en sus dependencias lo más pronto posible.

Tabla de vulnerabilidades corregidas en la actualización de Diciembre 2021:

AplicacionesCVE IDTitulo del CVENivel de importancia
AppsCVE-2021-43890Windows AppX Installer Spoofing VulnerabilityImportante
ASP.NET Core & Visual StudioCVE-2021-43877ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityImportante
Azure Bot Framework SDKCVE-2021-43225Bot Framework SDK Remote Code Execution VulnerabilityImportante
BizTalk ESB ToolkitCVE-2021-43892Microsoft BizTalk ESB Toolkit Spoofing VulnerabilityImportante
Internet Storage Name ServiceCVE-2021-43215iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution Crítico
Microsoft Defender for IoTCVE-2021-41365Microsoft Defender for IoT Remote Code Execution VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-42311Microsoft Defender for IoT Remote Code Execution VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-42310Microsoft Defender for IoT Remote Code Execution Vulnerability Crítico
Microsoft Defender for IoTCVE-2021-43882Microsoft Defender for IoT Remote Code Execution VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-43888Microsoft Defender for IoT Information Disclosure VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-42314Microsoft Defender for IoT Remote Code Execution VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-42313Microsoft Defender for IoT Remote Code Execution VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-42312Microsoft Defender for IOT Elevation of Privilege VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-43889Microsoft Defender for IoT Remote Code Execution VulnerabilityImportante
Microsoft Defender for IoTCVE-2021-42315Microsoft Defender for IoT Remote Code Execution VulnerabilityImportante
Microsoft DevicesCVE-2021-43899Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability Crítico
Microsoft Edge (Chromium-based)CVE-2021-4056Chromium: CVE-2021-4056: Type Confusion in loaderUnknown
Microsoft Edge (Chromium-based)CVE-2021-4055Chromium: CVE-2021-4055 Heap buffer overflow in extensionsUnknown
Microsoft Edge (Chromium-based)CVE-2021-4054Chromium: CVE-2021-4054 Incorrect security UI in autofillUnknown
Microsoft Edge (Chromium-based)CVE-2021-4052Chromium: CVE-2021-4052 Use after free in web appsUnknown
Microsoft Edge (Chromium-based)CVE-2021-4053Chromium: CVE-2021-4053 Use after free in UIUnknown
Microsoft Edge (Chromium-based)CVE-2021-4065Chromium: CVE-2021-4065 Use after free in autofillUnknown
Microsoft Edge (Chromium-based)CVE-2021-4064Chromium: CVE-2021-4064 Use after free in screen captureUnknown
Microsoft Edge (Chromium-based)CVE-2021-4063Chromium: CVE-2021-4063 Use after free in developer toolsUnknown
Microsoft Edge (Chromium-based)CVE-2021-4068Chromium: CVE-2021-4068 Insufficient validation of untrusted input in new tab pageUnknown
Microsoft Edge (Chromium-based)CVE-2021-4067Chromium: CVE-2021-4067 Use after free in window managerUnknown
Microsoft Edge (Chromium-based)CVE-2021-4066Chromium: CVE-2021-4066 Integer underflow in ANGLEUnknown
Microsoft Edge (Chromium-based)CVE-2021-4059Chromium: CVE-2021-4059 Insufficient data validation in loaderUnknown
Microsoft Edge (Chromium-based)CVE-2021-4062Chromium: CVE-2021-4062 Heap buffer overflow in BFCacheUnknown
Microsoft Edge (Chromium-based)CVE-2021-4061Chromium: CVE-2021-4061 Type Confusion in V8Unknown
Microsoft Edge (Chromium-based)CVE-2021-4058Chromium: CVE-2021-4058 Heap buffer overflow in ANGLEUnknown
Microsoft Edge (Chromium-based)CVE-2021-4057Chromium: CVE-2021-4057 Use after free in file APIUnknown
Microsoft Local Security Authority Server (lsasrv)CVE-2021-43216Microsoft Local Security Authority Server (lsasrv) Information Disclosure VulnerabilityImportante
Microsoft Message QueuingCVE-2021-43236Microsoft Message Queuing Information Disclosure VulnerabilityImportante
Microsoft Message QueuingCVE-2021-43222Microsoft Message Queuing Information Disclosure VulnerabilityImportante
Microsoft OfficeCVE-2021-43875Microsoft Office Graphics Remote Code Execution VulnerabilityImportante
Microsoft OfficeCVE-2021-42295Visual Basic for Applications Information Disclosure VulnerabilityImportante
Microsoft OfficeCVE-2021-43905Microsoft Office app Remote Code Execution VulnerabilityCrítico
Microsoft Office AccessCVE-2021-42293Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege VulnerabilityImportante
Microsoft Office ExcelCVE-2021-43256Microsoft Excel Remote Code Execution VulnerabilityImportante
Microsoft Office SharePointCVE-2021-42309Microsoft SharePoint Server Remote Code Execution VulnerabilityImportante
Microsoft Office SharePointCVE-2021-42320Microsoft SharePoint Server Spoofing VulnerabilityImportante
Microsoft Office SharePointCVE-2021-43242Microsoft SharePoint Server Spoofing VulnerabilityImportante
Microsoft Office SharePointCVE-2021-42294Microsoft SharePoint Server Remote Code Execution VulnerabilityImportante
Microsoft PowerShellCVE-2021-43896Microsoft PowerShell Spoofing VulnerabilityImportante
Microsoft Windows Codecs LibraryCVE-2021-41360HEVC Video Extensions Remote Code Execution VulnerabilityImportante
Microsoft Windows Codecs LibraryCVE-2021-43248Windows Digital Media Receiver Elevation of Privilege VulnerabilityImportante
Microsoft Windows Codecs LibraryCVE-2021-43214Web Media Extensions Remote Code Execution VulnerabilityImportante
Microsoft Windows Codecs LibraryCVE-2021-40452HEVC Video Extensions Remote Code Execution VulnerabilityImportante
Microsoft Windows Codecs LibraryCVE-2021-40453HEVC Video Extensions Remote Code Execution VulnerabilityImportante
Microsoft Windows Codecs LibraryCVE-2021-43243VP9 Video Extensions Information Disclosure VulnerabilityImportante
Office Developer PlatformCVE-2021-43255Microsoft Office Trust Center Spoofing VulnerabilityImportante
Remote Desktop ClientCVE-2021-43233Remote Desktop Client Remote Code Execution Vulnerability Crítico
Role: Windows Fax ServiceCVE-2021-43234Windows Fax Service Remote Code Execution VulnerabilityImportante
Role: Windows Hyper-VCVE-2021-43246Windows Hyper-V Denial of Service VulnerabilityImportante
Visual Studio CodeCVE-2021-43891Visual Studio Code Remote Code Execution VulnerabilityImportante
Visual Studio CodeCVE-2021-43908Visual Studio Code Spoofing VulnerabilityImportante
Visual Studio Code – WSL ExtensionCVE-2021-43907Visual Studio Code WSL Extension Remote Code Execution Vulnerability Crítico
Windows Common Log File System DriverCVE-2021-43226Windows Common Log File System Driver Elevation of Privilege VulnerabilityImportante
Windows Common Log File System DriverCVE-2021-43224Windows Common Log File System Driver Information Disclosure VulnerabilityImportante
Windows Common Log File System DriverCVE-2021-43207Windows Common Log File System Driver Elevation of Privilege VulnerabilityImportante
Windows Digital TV TunerCVE-2021-43245Windows Digital TV Tuner Elevation of Privilege VulnerabilityImportante
Windows DirectXCVE-2021-43219DirectX Graphics Kernel File Denial of Service VulnerabilityImportante
Windows Encrypting File System (EFS)CVE-2021-43217Windows Encrypting File System (EFS) Remote Code Execution Vulnerability Crítico
Windows Encrypting File System (EFS)CVE-2021-43893Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityImportante
Windows Event TracingCVE-2021-43232Windows Event Tracing Remote Code Execution VulnerabilityImportante
Windows InstallerCVE-2021-43883Windows Installer Elevation of Privilege VulnerabilityImportante
Windows KernelCVE-2021-43244Windows Kernel Information Disclosure VulnerabilityImportante
Windows MediaCVE-2021-40441Windows Media Center Elevation of Privilege VulnerabilityImportante
Windows Mobile Device ManagementCVE-2021-43880Windows Mobile Device Management Elevation of Privilege VulnerabilityImportante
Windows NTFSCVE-2021-43240NTFS Set Short Name Elevation of Privilege VulnerabilityImportante
Windows NTFSCVE-2021-43231Windows NTFS Elevation of Privilege VulnerabilityImportante
Windows NTFSCVE-2021-43230Windows NTFS Elevation of Privilege VulnerabilityImportante
Windows NTFSCVE-2021-43229Windows NTFS Elevation of Privilege VulnerabilityImportante
Windows Print Spooler ComponentsCVE-2021-41333Windows Print Spooler Elevation of Privilege VulnerabilityImportante
Windows Remote Access Connection ManagerCVE-2021-43223Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityImportante
Windows Remote Access Connection ManagerCVE-2021-43238Windows Remote Access Elevation of Privilege VulnerabilityImportante
Windows StorageCVE-2021-43235Storage Spaces Controller Information Disclosure VulnerabilityImportante
Windows Storage Spaces ControllerCVE-2021-43227Storage Spaces Controller Information Disclosure VulnerabilityImportante
Windows SymCryptCVE-2021-43228SymCrypt Denial of Service VulnerabilityImportante
Windows TCP/IPCVE-2021-43247Windows TCP/IP Driver Elevation of Privilege VulnerabilityImportante
Windows Update StackCVE-2021-43237Windows Setup Elevation of Privilege VulnerabilityImportante
Windows Update StackCVE-2021-43239Windows Recovery Environment Agent Elevation of Privilege VulnerabilityImportante

Artículos Relacionados

Protege tus aplicaciones Web y API

Accede a una evaluación completamente funciona

La primera solución completa que cubre los errores de seguridad y fallas de la lógica empresarial en todo el SDLC
Ir al Demo
Alterta Temprana de Riesgos
Reduce tu ventana de exposición al riesgo a las amenazas externas, mejorando la eficiencia en la detección y respuesta ante ciberamenazas.
Más Info
Protección de Dominios - Sendmarc
Evita y protege activamente los dominios de tu organización contra los ataques de suplantación de identidad y phishing
Más Info
Endpoint - Panda Security
Endpoint Protection Platform, EDR y Servicios de 100% Atestación y Threat Hunting integrado
Más Info

Últimos Artículos

Hablemos

Si tienes alguna duda o pregunta con nuestros servicios, puedes comunicarte directamente con nosotros o completar el formulario, y nos pondremos en contacto contigo en breve.

Email

contacto@cronup.com

Ubicación

Providencia, Santiago de Chile

Twitter

@Cronup_CyberSec

Linkedin

Cronup Ciberseguridad

CronUp Newsletter

Suscríbete a nuestro resumen semanal de noticias y alertas de seguridad para mantenerte actualizado sobre el panorama de amenazas en la región y el mundo.

* indicates required