Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
On Wednesday, CERT-In issued alerts for numerous vulnerabilities in Microsoft products including Microsoft Exchange, the Microsoft Windows Support Diagnostic Tool and the Red Hat Linux Kernel. These vulnerabilities are said to be used by remote attackers to access sensitive information and execute arbitrary code on Microsoft products, while in the Red Hat Linux Kernel they can be exploited to gain elevated privileges and access sensitive information.
In Microsoft products
Microsoft products include Windows, Microsoft Office, Microsoft Exchange Server, Azure, System Center Operations Manager, and Visual Studio, which can be exploited by an attacker to access sensitive information, bypass security restrictions, perform denial of service and spoofing attacks, or execute arbitrary code . on targeted systems.
In Microsoft Windows and Office systems, the vulnerability could be used by remote attackers to gain elevated privileges, disclose information by bypassing security restrictions, and cause a denial of service.
In Microsoft Exchange Server and Azure, the vulnerability could be used by attackers to disclose information by gaining elevated privileges on the target system. A very serious vulnerability in Microsoft Exchange could be used by an attacker to read email messages on targeted systems.
The vulnerability in Exchange exists due to improper access restrictions, and attackers are known to exploit this by tricking victims into opening specially crafted content.
And while vulnerabilities in System Center Operations Manager can allow attackers to gain elevated privileges, in Visual Studio attackers can remotely execute code to perform spoofing attacks.
High-severity vulnerabilities have also been reported in the Microsoft Windows Support Diagnostic Tool (MSDT), which could allow a remote attacker to execute arbitrary code on a target system.
According to CERT-In, this vulnerability exists due to a cross-path weakness and has been exploited by remote attackers by sending specially crafted requests to targeted systems.
Appropriate software updates are recommended to patch vulnerabilities.
In the Red Hat Linux kernel
Moderate vulnerabilities in the Red Hat Linux Kernel exist due to an information leak in scsiioctIO); use-after-free to new tfilter) in net/sched/cls_api.c; Incomplete cleanup of multi-core shared buffers (aka SBDR), micro-architecture padding buffers (aka BDS), and specific special register write operations (aka DRP.
This vulnerability has been reported to have been exploited by sending specially crafted requests to gain elevated privileges on target systems.
Successful exploitation of these vulnerabilities could allow attackers to obtain sensitive information or gain elevated privileges.
Application of appropriate software patches has been suggested to remove these vulnerabilities.
