Kaspersky LabKLA48842KLA48842 Multiple vulnerabilities in Microsoft Products (ESU)
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.2 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.96 High
EPSS
Percentile
99.0%
Detect date:
04/11/2023
Severity:
Critical
Description:
Multiple vulnerabilities were found in Microsoft Products (Extended Security Update). Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information, spoof user interface, bypass security restrictions.
Exploitation:
Public exploits exist for this vulnerability.
Affected products:
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Microsoft SQL Server 2008 R2 for x64-Based Systems Service Pack 3 (QFE)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Microsoft SQL Server 2008 R2 for 32-Bit Systems Service Pack 3 (QFE)
Microsoft SQL Server 2008 for 32-bit Systems Service Pack 4 (QFE)
Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)
Microsoft SQL Server 2012 for 32-bit Systems Service Pack 4 (QFE)
Microsoft SQL Server 2008 for x64-Based Systems Service Pack 4 (QFE)
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2023-28272
CVE-2023-28306
CVE-2023-28298
CVE-2023-28267
CVE-2023-28228
CVE-2023-28240
CVE-2023-28238
CVE-2023-28250
CVE-2023-28308
CVE-2023-28244
CVE-2023-28252
CVE-2023-28218
CVE-2023-24931
CVE-2023-28229
CVE-2023-28293
CVE-2023-28231
CVE-2023-28232
CVE-2023-28219
CVE-2023-28275
CVE-2023-21554
CVE-2023-28271
CVE-2023-24912
CVE-2023-28254
CVE-2023-28253
CVE-2023-28268
CVE-2023-28255
CVE-2023-28305
CVE-2023-28241
CVE-2023-28217
CVE-2023-28216
CVE-2023-28302
CVE-2023-28227
CVE-2023-28256
CVE-2023-28278
CVE-2023-28276
CVE-2023-21727
CVE-2023-28222
CVE-2023-28307
CVE-2023-28220
CVE-2023-23384
CVE-2023-28223
CVE-2023-28266
CVE-2023-21729
CVE-2023-21769
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2023-282727.8Critical
CVE-2023-283066.6High
CVE-2023-282985.5High
CVE-2023-282676.5High
CVE-2023-282285.5High
CVE-2023-282408.8Critical
CVE-2023-282387.5Critical
CVE-2023-282509.8Critical
CVE-2023-283086.6High
CVE-2023-282448.1Critical
CVE-2023-282527.8Critical
CVE-2023-282187.0High
CVE-2023-249317.5Critical
CVE-2023-282297.0High
CVE-2023-282937.8Critical
CVE-2023-282318.8Critical
CVE-2023-282327.5Critical
CVE-2023-282198.1Critical
CVE-2023-282758.8Critical
CVE-2023-215549.8Critical
CVE-2023-282715.5High
CVE-2023-249127.8Critical
CVE-2023-282547.2High
CVE-2023-282535.5High
CVE-2023-282688.1Critical
CVE-2023-282556.6High
CVE-2023-283056.6High
CVE-2023-282417.5Critical
CVE-2023-282177.5Critical
CVE-2023-282167.0High
CVE-2023-283027.5Critical
CVE-2023-282277.5Critical
CVE-2023-282566.6High
CVE-2023-282786.6High
CVE-2023-282764.4Warning
CVE-2023-217278.8Critical
CVE-2023-282227.1High
CVE-2023-283076.6High
CVE-2023-282208.1Critical
CVE-2023-233847.3High
CVE-2023-282236.6High
CVE-2023-282665.5High
CVE-2023-217295.3High
CVE-2023-217697.5Critical
KB list:
5021123
5021112
5020863
5025279
5025271
5025277
5025273
Microsoft official advisories:
References
support.microsoft.com/kb/5020863
support.microsoft.com/kb/5021112
support.microsoft.com/kb/5021123
support.microsoft.com/kb/5025271
support.microsoft.com/kb/5025273
support.microsoft.com/kb/5025277
support.microsoft.com/kb/5025279
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21554
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21727
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21729
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21769
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23384
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24912
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24931
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28216
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28217
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28218
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28219
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28220
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28222
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28223
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28227
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28228
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28229
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28231
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28232
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28238
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28240
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28241
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28244
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28250
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28252
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28253
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28254
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28255
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28256
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28266
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28267
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28268
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28271
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28272
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28275
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28276
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28278
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28293
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28298
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28302
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28305
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28306
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28307
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28308
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21554
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21727
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21729
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21769
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23384
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24912
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24931
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28216
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28217
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28218
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28219
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28220
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28222
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28223
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28227
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28228
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28231
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28232
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28238
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28240
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28241
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28244
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28250
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28253
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28254
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28255
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28256
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28266
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28267
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28268
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28271
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28272
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28275
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28276
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28278
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28293
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28298
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28302
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28305
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28306
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28307
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28308
portal.msrc.microsoft.com/en-us/security-guidance
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/class/Exploit/
threats.kaspersky.com/en/product/Microsoft-SQL-Server/
threats.kaspersky.com/en/product/Microsoft-Windows-Server-2008/
threats.kaspersky.com/en/product/Microsoft-Windows-Server/
threats.kaspersky.com/en/product/Microsoft-Windows/
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.2 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.96 High
EPSS
Percentile
99.0%