CSIRT Panamá Aviso 2017-10-11 Microsoft libera actualizaciones para 53 vulnerabilidades
Gravedad: Alta
Fecha de publicación: Noviembre 16, 2017
Fecha de modificación: Noviembre 15, 2017
Última revisión: Revisión A.
https://portal.msrc.microsoft.com/en-us/security-guidance
Sistemas Afectados:
ASP.NET Core
.NET Framework
Adobe Flash Player
ASP .NET
ASP.NET
Device Guard
Internet Explorer
Microsoft Browsers
Microsoft Edge
Microsoft Graphics Component
Microsoft Office
Microsoft Scripting Engine
Microsoft Windows Search Component
Windows Kernel
Windows Kernel-Mode Drivers
Windows Media Player
I. Descripción
Microsoft ha liberado actualizaciones que cubren 53 vulnerabilidades.
II. Impacto
Estas correcciones o parches estan detalladas en la tabla a continuacion
| Tag | CVE ID | CVE Title |
|---|---|---|
| ASP.NET Core | CVE-2017-11883 | ASP.NET Core Denial Of Service Vulnerability |
| .NET Framework | CVE-2017-11770 | .NET CORE Denial Of Service Vulnerability |
| Adobe Flash Player | ADV170019 | November 2017 Flash Security Updates |
| ASP .NET | CVE-2017-8700 | ASP.NET Core Information Disclosure Vulnerability |
| ASP.NET | CVE-2017-11879 | ASP.NET Core Elevation Of Privilege Vulnerability |
| Device Guard | CVE-2017-11830 | Device Guard Security Feature Bypass Vulnerability |
| Internet Explorer | CVE-2017-11856 | Internet Explorer Memory Corruption Vulnerability |
| Internet Explorer | CVE-2017-11855 | Internet Explorer Memory Corruption Vulnerability |
| Internet Explorer | CVE-2017-11848 | Internet Explorer Information Disclosure Vulnerability |
| Microsoft Browsers | CVE-2017-11827 | Microsoft Browser Memory Corruption Vulnerability |
| Microsoft Edge | CVE-2017-11845 | Microsoft Edge Memory Corruption Vulnerability |
| Microsoft Edge | CVE-2017-11874 | Microsoft Edge Security Feature Bypass Vulnerability |
| Microsoft Edge | CVE-2017-11872 | Microsoft Edge Security Feature Bypass Vulnerability |
| Microsoft Edge | CVE-2017-11863 | Microsoft Edge Security Feature Bypass Vulnerability |
| Microsoft Edge | CVE-2017-11833 | Microsoft Edge Information Disclosure Vulnerability |
| Microsoft Edge | CVE-2017-11803 | Microsoft Edge Information Disclosure Vulnerability |
| Microsoft Edge | CVE-2017-11844 | Microsoft Edge Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2017-11835 | Windows EOT Font Engine Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2017-11832 | Windows EOT Font Engine Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2017-11851 | Windows Kernel Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2017-11852 | Windows GDI Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2017-11850 | Microsoft Graphics Component Information Disclosure Vulnerability |
| Microsoft Office | CVE-2017-11882 | Microsoft Office Memory Corruption Vulnerability |
| Microsoft Office | ADV170020 | Microsoft Office Defense in Depth Update |
| Microsoft Office | CVE-2017-11854 | Microsoft Word Memory Corruption Vulnerability |
| Microsoft Office | CVE-2017-11884 | Microsoft Office Memory Corruption Vulnerability |
| Microsoft Office | CVE-2017-11878 | Microsoft Excel Memory Corruption Vulnerability |
| Microsoft Office | CVE-2017-11876 | Microsoft Project Server Elevation of Privilege Vulnerability |
| Microsoft Office | CVE-2017-11877 | Microsoft Excel Security Feature Bypass Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11862 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11858 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11846 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11869 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11866 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11837 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11839 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11861 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11841 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11873 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11834 | Scripting Engine Information Disclosure Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11791 | Scripting Engine Information Disclosure Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11871 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11870 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11840 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11843 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11836 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2017-11838 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Windows Search Component | CVE-2017-11788 | Windows Search Denial of Service Vulnerability |
| Windows Kernel | CVE-2017-11880 | Windows Information Disclosure Vulnerability |
| Windows Kernel | CVE-2017-11831 | Windows Information Disclosure Vulnerability |
| Windows Kernel | CVE-2017-11847 | Windows Kernel Elevation of Privilege Vulnerability |
| Windows Kernel-Mode Drivers | CVE-2017-11853 | Windows Kernel Information Disclosure Vulnerability |
| Windows Kernel-Mode Drivers | CVE-2017-11849 | Windows Kernel Information Disclosure Vulnerability |
| Windows Kernel-Mode Drivers | CVE-2017-11842 | Windows Kernel Information Disclosure Vulnerability |
| Windows Media Player | CVE-2017-11768 | Windows Media Player Information Disclosure Vulnerability |
III. Referencia a soluciones, herramientas e información
Se recomienda actualizar Windows utilizando la herramienta de Windows update o WSUS para Windows server.
https://www.microsoft.com/en-us/security/pc-security/malware-removal.aspx
Instale los parches tan pronto como estén disponibles.
Ejecute todo el software con los menos privilegios requeridos mientras se mantiene la funcionalidad.
Para mas referencias seguir el siguiente enlace https://portal.msrc.microsoft.com/en-us/security-guidance
IV. Información de contacto
CSIRT PANAMA
Computer Security Incident Response Team Autoridad Nacional para la
Innovacion Gubernamental
E-Mail: info@cert.pa
Phone: +507 520-CERT (2378)
Web: https://cert.pa
Twitter: @CSIRTPanama
Facebook: http://www.facebook.com/CSIRTPanama
Key ID: 16F2B124