Alert GCSA-22028 - Microsoft Security Update Marzo 2022

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1





******************************************************************

Alert ID: GCSA-22028
Data: 09 Marzo 2022
Titolo: Microsoft Security Update Marzo 2022

******************************************************************

:: Descrizione del problema

Microsoft ha rilasciato il security update mensile per marzo 2022,
questa versione risolve 71 vulnerabilita', tra cui TRE zero-day.
Inoltre, 8 vulnerabilita' sono state classificate come "Critical".

Maggiori dettagli sono disponibili alla sezione "Riferimenti".


:: Software interessato

.NET
Visual Studio
Azure Site Recovery
Microsoft Defender for Endpoint
Microsoft Defender for IoT
Microsoft Edge (Chromium-based)
Microsoft Exchange Server
Microsoft Intune
Microsoft Office Visio
Microsoft Office Word
Microsoft Windows ALPC
Microsoft Windows Codecs Library
Paint 3D
Windows Hyper-V
Skype Extension for Chrome
Tablet Windows User Interface
Visual Studio Code
Windows Ancillary Function Driver for WinSock
Windows CD-ROM Driver
Windows Cloud Files Mini Filter Driver
Windows COM
Windows Common Log File System Driver
Windows DWM Core Library
Windows Event Tracing
Windows Fastfat Driver
Windows Fax and Scan Service
Windows HTML Platform
Windows Installer
Windows Kernel
Windows Media
Windows PDEV
Windows Point-to-Point Tunneling Protocol
Windows Print Spooler Components
Windows Remote Desktop
Windows Security Support Provider Interface
Windows SMB Server
Windows Update Stack
XBox


:: Impatto

Esecuzione remota di codice arbitrario (RCE)
Denial of Service (DoS)
Acquisizione di privilegi piu' elevati (EoP)
Provide Misleading Information (spoofing)
Information Disclosure (ID)
Bypass delle funzionalita' di sicurezza (SFB)
Manipolazione dei dati (DM)


:: Soluzioni

Per default l'installazione degli aggiornamenti
avviene in maniera automatica.

Per installare manualmente scegliere
Start > Impostazioni > Aggiornamento e Sicurezza > Windows Update

Verificare di aver installato la versione piu' recente del
Servicing Stack Updates
https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV990001
https://docs.microsoft.com/it-it/windows/deployment/update/servicing-stack-updates

Windows Update domande frequenti
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Gli aggiornamenti sono disponibili anche tramite il catalogo di Microsoft Update
https://www.catalog.update.microsoft.com/

Gli utenti che utilizzano ancora Windows 7, Windows Server 2008 o 2008 R2
devono acquistare l'Extended Security Update per continuare a ricevere gli aggiornamenti
https://support.microsoft.com/en-hk/help/4522133/procedure-to-continue-receiving-security-updates


:: Riferimenti

Microsoft Security Updates - Release Notes
https://msrc.microsoft.com/update-guide/releaseNote/2022-Mar
https://msrc.microsoft.com/update-guide/

CSIRT Italia
https://csirt.gov.it/contenuti/aggiornamenti-mensili-microsoft-al01-220309-csirt-ita

US-CERT
https://www.cisa.gov/uscert/ncas/current-activity/2022/03/08/microsoft-releases-march-2022-security-updates

Mitre CVE
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8927
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36927
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0603
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0604
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0605
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0606
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0607
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0608
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0609
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0610
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0789
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0790
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0791
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0792
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0794
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0795
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0796
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0798
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0799
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0800
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0801
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0802
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0804
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0805
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0808
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0809
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21957
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21967
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21973
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21975
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21977
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21990
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21999
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22003
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22006
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22007
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22010
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23253
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23265
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23266
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23280
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23281
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23282
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23283
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23284
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23286
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23287
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23288
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23290
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23291
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23293
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23294
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23296
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23298
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23299
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23301
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24451
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24452
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24453
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24454
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24455
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24456
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24457
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24459
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24460
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24465
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24467
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24468
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24470
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24471
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24502
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24503
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24505
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24506
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24508
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24509
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24511
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24512
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24515
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24517
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24518
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24519
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24520
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24522
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24525
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24526




GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAmIohNMACgkQwZxMk2USYEIQ9wCfWY7SEbA+R0WnzAojCMcH0zhq
GMEAnAswc6EEa12jsEvSrVsKhO/byQCn
=JELU
-----END PGP SIGNATURE-----