Alert GCSA-23115 - Microsoft Monthly Security Update - Settembre 2023
******************************************************************
Alert ID: GCSA-23115
Data: 14 Settembre 2023
Titolo: Microsoft Monthly Security Update - Settembre 2023
******************************************************************
:: Descrizione del problema
Microsoft ha pubblicato il security update per il mese di Settembre 2023,
con questa release vengono risolte 59 vulnerabilita', di cui 2 0-day.
NOTA: le vulnerabilita' CVE-2023-36802 (Microsoft Straming Service Proxy)
e CVE-2023-36761 (Microsoft Word) sono in corso di sfruttamento attivo.
Maggiori dettagli sono disponibili alla sezione "Riferimenti".
:: Software / Tecnologie interessate
.NET and Visual Studio
.NET Core & Visual Studio
.NET Framework
3D Builder
3D Viewer
Azure DevOps
Azure HDInsights
Microsoft Azure Kubernetes Service
Microsoft Dynamics
Microsoft Dynamics Finance & Operations
Microsoft Exchange Server
Microsoft Identity Linux Broker
Microsoft Office
Microsoft Office Excel
Microsoft Office Outlook
Microsoft Office SharePoint
Microsoft Office Word
Microsoft Streaming Service
Microsoft Windows Codecs Library
Visual Studio
Visual Studio Code
Windows Cloud Files Mini Filter Driver
Windows Common Log File System Driver
Windows Defender
Windows DHCP Server
Windows GDI
Windows Internet Connection Sharing (ICS)
Windows Kernel
Windows Scripting
Windows TCP/IP
Windows Themes
:: Impatto
Esecuzione remota di codice arbitrario (RCE)
Acquisizione di privilegi piu' elevati (EoP)
Denial of Service (DoS)
Rivelazione di informazioni (ID)
Bypass delle funzionalita' di sicurezza (SFB)
Provide Misleading Information (spoofing)
:: Soluzioni
In Windows per default gli aggiornamenti
avvengono in maniera automatica.
Per verificare manualmente la disponibilita' di aggiornamenti scegliere
Start > Impostazioni > Aggiornamento e Sicurezza > Windows Update
Verificare di aver installato la versione piu' recente del
Servicing Stack Updates
https://msrc.microsoft.com/update-guide/vulnerability/ADV990001
https://docs.microsoft.com/it-it/windows/deployment/update/servicing-stack-updates
MSRC Security Update Guide
https://msrc.microsoft.com/update-guide/deployments
Windows Update domande frequenti
https://support.microsoft.com/en-us/help/12373/windows-update-faq
Gli aggiornamenti sono disponibili anche tramite WSUS ed il
catalogo di Microsoft Update
https://www.catalog.update.microsoft.com/
:: Riferimenti
Microsoft Security Updates - Release Notes
https://msrc.microsoft.com/update-guide/releaseNote/2023-Sep
https://msrc.microsoft.com/update-guide/
Microsoft Security Update Guidance
https://portal.msrc.microsoft.com/en-us/security-guidance
CSIRT Italia
https://www.csirt.gov.it/contenuti/aggiornamenti-mensili-microsoft-al01-230913-csirt-ita
CIS - Center for Internet Security
https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-12-2023_2023-104
SANS ISC Diary
https://isc.sans.edu/diary/Microsoft+September+2023+Patch+Tuesday/30214/
Mitre CVE
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41303
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29332
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33136
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35355
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36736
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36739
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36740
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36742
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36744
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36745
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36756
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36757
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36758
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36759
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36760
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36761
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36762
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36763
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36764
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36765
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36766
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36767
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36770
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36771
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36772
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36773
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36777
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36788
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36792
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36793
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36794
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36796
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36799
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36800
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36801
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36802
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36803
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36804
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36805
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36886
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38139
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38140
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38141
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38142
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38143
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38144
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38146
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38147
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38148
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38149
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38150
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38152
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38155
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38156
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38160
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38161
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38162
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38163
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38164
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39956
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41764
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4761
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4762
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4763
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4764
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863
GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----
iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCZQLXzwAKCRDBnEyTZRJg
Qty/AKDfHvNuzFYLj0C5NBFwPopDM7NjmwCgoj1BUYN/0mmpDP1FGJsaGR1ya7g=
=EW3V
-----END PGP SIGNATURE-----