CSIRT Panamá Aviso 2019-12-12 Microsoft libera sus actualizaciones de diciembre que corrigen el Zero day Win32k y 36 Fallas
Gravedad: Alta
Fecha de publicación: Diciembre 12, 2019
Última revisión: Diciembre 12, 2019
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2019-Dec
Sistemas Afectados:
Microsoft Windows
Internet Explorer
Microsoft Office and Microsoft Office Services and Web Apps
SQL Server
Visual Studio
Skype for Business
I. Descripción
Microsoft publicó las siguientes actualizaciones de seguridad correspondientes este mes.
II. Problemas Conocidos
| Tag | CVE ID | CVE Title | Severity |
|---|---|---|---|
| ADV190026 | Microsoft Guidance for cleaning up orphaned keys generated on vulnerable TPMs and used for Windows Hello for Business | Unknown | |
| End of Life Software | CVE-2019-1489 | Remote Desktop Protocol Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2019-1465 | Windows GDI Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2019-1468 | Win32k Graphics Remote Code Execution Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2019-1466 | Windows GDI Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2019-1467 | Windows GDI Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2019-1400 | Microsoft Access Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2019-1464 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2019-1461 | Microsoft Word Denial of Service Vulnerability | Important |
| Microsoft Office | CVE-2019-1462 | Microsoft PowerPoint Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2019-1463 | Microsoft Access Information Disclosure Vulnerability | Important |
| Microsoft Scripting Engine | CVE-2019-1485 | VBScript Remote Code Execution Vulnerability | Low |
| Microsoft Windows | CVE-2019-1453 | Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability | Important |
| Microsoft Windows | CVE-2019-1476 | Windows Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2019-1477 | Windows Printer Service Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2019-1474 | Windows Kernel Information Disclosure Vulnerability | Important |
| Microsoft Windows | CVE-2019-1478 | Windows COM Server Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2019-1483 | Windows Elevation of Privilege Vulnerability | Important |
| Microsoft Windows | CVE-2019-1488 | Microsoft Defender Security Feature Bypass Vulnerability | Important |
| Open Source Software | CVE-2019-1487 | Microsoft Authentication Library for Android Information Disclosure Vulnerability | Important |
| Servicing Stack Updates | ADV990001 | Latest Servicing Stack Updates | Critical |
| Skype for Business | CVE-2019-1490 | Skype for Business Server Spoofing Vulnerability | Important |
| SQL Server | CVE-2019-1332 | Microsoft SQL Server Reporting Services XSS Vulnerability | Important |
| Visual Studio | CVE-2019-1350 | Git for Visual Studio Remote Code Execution Vulnerability | Critical |
| Visual Studio | CVE-2019-1349 | Git for Visual Studio Remote Code Execution Vulnerability | Critical |
| Visual Studio | CVE-2019-1486 | Visual Studio Live Share Spoofing Vulnerability | Important |
| Visual Studio | CVE-2019-1387 | Git for Visual Studio Remote Code Execution Vulnerability | Critical |
| Visual Studio | CVE-2019-1354 | Git for Visual Studio Remote Code Execution Vulnerability | Critical |
| Visual Studio | CVE-2019-1351 | Git for Visual Studio Tampering Vulnerability | Moderate |
| Visual Studio | CVE-2019-1352 | Git for Visual Studio Remote Code Execution Vulnerability | Critical |
| Windows Hyper-V | CVE-2019-1471 | Windows Hyper-V Remote Code Execution Vulnerability | Critical |
| Windows Hyper-V | CVE-2019-1470 | Windows Hyper-V Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2019-1472 | Windows Kernel Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2019-1458 | Win32k Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2019-1469 | Win32k Information Disclosure Vulnerability | Important |
| Windows Media Player | CVE-2019-1480 | Windows Media Player Information Disclosure Vulnerability | Important |
| Windows Media Player | CVE-2019-1481 | Windows Media Player Information Disclosure Vulnerability | Important |
| Windows OLE | CVE-2019-1484 | Windows OLE Remote Code Execution Vulnerability | Important |
III. Referencia a soluciones, herramientas e información
Actualizar utilizando Windows Update
IV. Información de contacto
CSIRT PANAMA
Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
E-Mail: info@cert.pa
Phone: +507 520-CERT (2378)
Web: https://cert.pa
Twitter: @CSIRTPanama
Facebook: http://www.facebook.com/CSIRTPanama
Key ID: 16F2B124