Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-24860 (GCVE-0-2023-24860)
Vulnerability from cvelistv5 – Published: 2023-04-11 19:13 – Updated: 2025-02-28 20:49
VLAI?
EPSS
Title
Microsoft Defender Denial of Service Vulnerability
Summary
Microsoft Defender Denial of Service Vulnerability
Severity ?
CWE
- Denial of Service
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microsoft | Microsoft Malware Protection Engine |
Affected:
1.1.0.0 , < 1.1.20200.4
(custom)
|
Date Public ?
2023-04-11 07:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:11:42.141Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Defender Denial of Service Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-24860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-28T20:20:20.296108Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T20:49:00.168Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Microsoft Malware Protection Engine",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.1.20200.4",
"status": "affected",
"version": "1.1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.20200.4",
"versionStartIncluding": "1.1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-04-11T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Defender Denial of Service Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of Service",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-23T01:04:33.664Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Defender Denial of Service Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
}
],
"title": "Microsoft Defender Denial of Service Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-24860",
"datePublished": "2023-04-11T19:13:26.147Z",
"dateReserved": "2023-01-31T20:32:35.462Z",
"dateUpdated": "2025-02-28T20:49:00.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-24860",
"date": "2026-04-16",
"epss": "0.04095",
"percentile": "0.88603"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.1.20200.4\", \"matchCriteriaId\": \"821D2304-26E3-4513-8548-DF7F2D552ABD\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Microsoft Defender Denial of Service Vulnerability\"}]",
"id": "CVE-2023-24860",
"lastModified": "2024-11-21T07:48:35.077",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
"published": "2023-04-11T21:15:18.613",
"references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-24860\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-04-11T21:15:18.613\",\"lastModified\":\"2025-02-28T21:15:20.647\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Microsoft Defender Denial of Service Vulnerability\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.20200.4\",\"matchCriteriaId\":\"821D2304-26E3-4513-8548-DF7F2D552ABD\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Microsoft Defender Denial of Service Vulnerability\", \"datePublic\": \"2023-04-11T07:00:00.000Z\", \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.1.0.0\", \"versionEndExcluding\": \"1.1.20200.4\"}]}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"Microsoft Malware Protection Engine\", \"platforms\": [\"Unknown\"], \"versions\": [{\"version\": \"1.1.0.0\", \"lessThan\": \"1.1.20200.4\", \"versionType\": \"custom\", \"status\": \"affected\"}]}], \"descriptions\": [{\"value\": \"Microsoft Defender Denial of Service Vulnerability\", \"lang\": \"en-US\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Denial of Service\", \"lang\": \"en-US\", \"type\": \"Impact\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2025-01-23T01:04:33.664Z\"}, \"references\": [{\"name\": \"Microsoft Defender Denial of Service Vulnerability\", \"tags\": [\"vendor-advisory\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860\"}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}], \"cvssV3_1\": {\"version\": \"3.1\", \"baseSeverity\": \"HIGH\", \"baseScore\": 7.5, \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C\"}}]}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T11:11:42.141Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"name\": \"Microsoft Defender Denial of Service Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_transferred\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-24860\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-28T20:20:20.296108Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-28T20:20:21.641Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2023-24860\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"microsoft\", \"dateReserved\": \"2023-01-31T20:32:35.462Z\", \"datePublished\": \"2023-04-11T19:13:26.147Z\", \"dateUpdated\": \"2025-02-28T20:49:00.168Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
MSRC_CVE-2023-24860
Vulnerability from csaf_microsoft - Published: 2023-04-11 07:00 - Updated: 2023-04-12 07:00Summary
Microsoft Defender Denial of Service Vulnerability
Severity
Important
Notes
Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.
Vendor Fix
1.1.20200.4:Security Update:https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide
https://docs.microsoft.com/en-us/microsoft-365/se…
References
Acknowledgments
Tomer Bar with SafeBreach
Shmuel Cohen with SafeBreach
{
"document": {
"acknowledgments": [
{
"names": [
"Tomer Bar with SafeBreach"
]
},
{
"names": [
"Shmuel Cohen with SafeBreach "
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2023-24860 Microsoft Defender Denial of Service Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
},
{
"category": "self",
"summary": "CVE-2023-24860 Microsoft Defender Denial of Service Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-24860.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Microsoft Defender Denial of Service Vulnerability",
"tracking": {
"current_release_date": "2023-04-12T07:00:00.000Z",
"generator": {
"date": "2025-01-23T01:04:30.263Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2023-24860",
"initial_release_date": "2023-04-11T07:00:00.000Z",
"revision_history": [
{
"date": "2023-04-11T07:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2023-04-12T07:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added acknowledgements. This is an informational change only."
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.1.20200.4",
"product": {
"name": "Microsoft Malware Protection Engine \u003c1.1.20200.4",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "1.1.20200.4",
"product": {
"name": "Microsoft Malware Protection Engine 1.1.20200.4",
"product_id": "11902"
}
}
],
"category": "product_name",
"name": "Microsoft Malware Protection Engine"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-24860",
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "Last version of the Microsoft Malware Protection Engine affected by this vulnerability: Last version of the Microsoft Malware Protection Engine affected by this vulnerability, 1.1.20100.6: 1.1.20100.6, First version of the Microsoft Malware Protection Engine with this vulnerability addressed: First version of the Microsoft Malware Protection Engine with this vulnerability addressed, Version 1.1.20200.4: Version 1.1.20200.4\nSee Manage Updates Baselines Microsoft Defender Antivirus for more information.\nVulnerability scanners are looking for specific binaries and version numbers on devices. Microsoft Defender files are still on disk even when disabled. Systems that have disabled Microsoft Defender are not in an exploitable state.\nIn response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.\nFor enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.\nBest practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.\nMicrosoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.\nDepending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.\nThe Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.\nDefender runs on all supported version of Windows.\nYes, Microsoft System Center Endpoint Protection, Microsoft System Center 2012 R2 Endpoint Protection, Microsoft System Center 2012 Endpoint Protection and Microsoft Security Essentials.\nYes.\u00a0 In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.\nCustomers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.\nOpen the Windows Security program. For example, type Security in the Search bar, and select the Windows Security program.\nIn the navigation pane, select Virus \u0026amp; threat protection.\nUnder Virus \u0026amp; threat protection updates in the main window, select Check for updates\nSelect Check for updates again.\nIn the navigation pane, select Settings, and then select About.\nExamine the Engine Version number. The update was successfully installed if the Malware Protection Engine version number or the signature package version number matches or exceeds the version number that you are trying to verify as installed.",
"title": "Microsoft Defender is disabled in my environment, why are vulnerability scanners showing that I am vulnerable to this issue?"
}
],
"product_status": {
"fixed": [
"11902"
],
"known_affected": [
"1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-24860 Microsoft Defender Denial of Service Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
},
{
"category": "self",
"summary": "CVE-2023-24860 Microsoft Defender Denial of Service Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-11T07:00:00.000Z",
"details": "1.1.20200.4:Security Update:https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide",
"product_ids": [
"1"
],
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Denial of Service"
},
{
"category": "exploit_status",
"details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
}
],
"title": "Microsoft Defender Denial of Service Vulnerability"
}
]
}
FKIE_CVE-2023-24860
Vulnerability from fkie_nvd - Published: 2023-04-11 21:15 - Updated: 2025-02-28 21:15
Severity ?
Summary
Microsoft Defender Denial of Service Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | malware_protection_engine | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*",
"matchCriteriaId": "821D2304-26E3-4513-8548-DF7F2D552ABD",
"versionEndExcluding": "1.1.20200.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Microsoft Defender Denial of Service Vulnerability"
}
],
"id": "CVE-2023-24860",
"lastModified": "2025-02-28T21:15:20.647",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"published": "2023-04-11T21:15:18.613",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
CERTFR-2023-AVI-0309
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à la confidentialité des données, une exécution de code à distance, une usurpation d'identité et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 18) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.5 | ||
| Microsoft | N/A | Microsoft OLE DB Driver 19 pour SQL Server | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2008 R2 pour x64-Based Systems Service Pack 3 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2012 pour systèmes 32 bits Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Raw Image Extension | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Malware Protection Engine | ||
| Microsoft | N/A | Microsoft SQL Server 2008 pour x64-Based Systems Service Pack 4 (QFE) | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft ODBC Driver 18 pour SQL Server | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2008 pour systèmes 32 bits Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2012 pour systèmes x64 Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft ODBC Driver 17 pour SQL Server | ||
| Microsoft | N/A | Microsoft OLE DB Driver 18 pour SQL Server | ||
| Microsoft | N/A | Microsoft SQL Server 2008 R2 pour 32-Bit Systems Service Pack 3 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) | ||
| Microsoft | N/A | Send Customer Voice survey from Dynamics 365 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 18)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 19 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 R2 pour x64-Based Systems Service Pack 3 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2012 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Raw Image Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Malware Protection Engine",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 pour x64-Based Systems Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 18 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2012 pour syst\u00e8mes x64 Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 17 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 18 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 R2 pour 32-Bit Systems Service Pack 3 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Send Customer Voice survey from Dynamics 365",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-28262",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28262"
},
{
"name": "CVE-2023-23375",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23375"
},
{
"name": "CVE-2023-28287",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28287"
},
{
"name": "CVE-2023-24860",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24860"
},
{
"name": "CVE-2023-28291",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28291"
},
{
"name": "CVE-2023-28313",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28313"
},
{
"name": "CVE-2023-28314",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28314"
},
{
"name": "CVE-2023-28285",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28285"
},
{
"name": "CVE-2023-28299",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28299"
},
{
"name": "CVE-2023-28296",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28296"
},
{
"name": "CVE-2023-24893",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24893"
},
{
"name": "CVE-2023-28263",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28263"
},
{
"name": "CVE-2023-28292",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28292"
},
{
"name": "CVE-2023-28304",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28304"
},
{
"name": "CVE-2023-28260",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28260"
},
{
"name": "CVE-2023-28295",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28295"
},
{
"name": "CVE-2023-28311",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28311"
},
{
"name": "CVE-2023-23384",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23384"
},
{
"name": "CVE-2023-28309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28309"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28292 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28292"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28287 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28287"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28304 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28304"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28296 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28296"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24893 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24893"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28291 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28291"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23375 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28285 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28285"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24860 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28262 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28262"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28314 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28314"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23384 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23384"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28309 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28309"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28260 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28295 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28295"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28313 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28313"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28263 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28263"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28311 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28299 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299"
}
],
"reference": "CERTFR-2023-AVI-0309",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, une ex\u00e9cution de code \u00e0 distance, une\nusurpation d\u0027identit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0309
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à la confidentialité des données, une exécution de code à distance, une usurpation d'identité et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 18) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.5 | ||
| Microsoft | N/A | Microsoft OLE DB Driver 19 pour SQL Server | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2008 R2 pour x64-Based Systems Service Pack 3 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2012 pour systèmes 32 bits Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Raw Image Extension | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Malware Protection Engine | ||
| Microsoft | N/A | Microsoft SQL Server 2008 pour x64-Based Systems Service Pack 4 (QFE) | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft ODBC Driver 18 pour SQL Server | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2008 pour systèmes 32 bits Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2012 pour systèmes x64 Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft ODBC Driver 17 pour SQL Server | ||
| Microsoft | N/A | Microsoft OLE DB Driver 18 pour SQL Server | ||
| Microsoft | N/A | Microsoft SQL Server 2008 R2 pour 32-Bit Systems Service Pack 3 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) | ||
| Microsoft | N/A | Send Customer Voice survey from Dynamics 365 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 18)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 19 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 R2 pour x64-Based Systems Service Pack 3 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2012 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Raw Image Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Malware Protection Engine",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 pour x64-Based Systems Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 18 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2012 pour syst\u00e8mes x64 Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 17 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 18 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 R2 pour 32-Bit Systems Service Pack 3 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Send Customer Voice survey from Dynamics 365",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-28262",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28262"
},
{
"name": "CVE-2023-23375",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23375"
},
{
"name": "CVE-2023-28287",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28287"
},
{
"name": "CVE-2023-24860",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24860"
},
{
"name": "CVE-2023-28291",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28291"
},
{
"name": "CVE-2023-28313",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28313"
},
{
"name": "CVE-2023-28314",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28314"
},
{
"name": "CVE-2023-28285",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28285"
},
{
"name": "CVE-2023-28299",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28299"
},
{
"name": "CVE-2023-28296",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28296"
},
{
"name": "CVE-2023-24893",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24893"
},
{
"name": "CVE-2023-28263",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28263"
},
{
"name": "CVE-2023-28292",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28292"
},
{
"name": "CVE-2023-28304",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28304"
},
{
"name": "CVE-2023-28260",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28260"
},
{
"name": "CVE-2023-28295",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28295"
},
{
"name": "CVE-2023-28311",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28311"
},
{
"name": "CVE-2023-23384",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23384"
},
{
"name": "CVE-2023-28309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28309"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28292 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28292"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28287 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28287"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28304 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28304"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28296 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28296"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24893 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24893"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28291 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28291"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23375 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28285 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28285"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24860 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28262 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28262"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28314 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28314"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23384 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23384"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28309 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28309"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28260 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28295 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28295"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28313 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28313"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28263 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28263"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28311 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28299 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299"
}
],
"reference": "CERTFR-2023-AVI-0309",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, une ex\u00e9cution de code \u00e0 distance, une\nusurpation d\u0027identit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
GHSA-QJ2R-8848-46QG
Vulnerability from github – Published: 2023-04-11 21:31 – Updated: 2023-04-11 21:31
VLAI?
Details
Microsoft Defender Denial of Service Vulnerability
Severity ?
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-24860"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-11T21:15:00Z",
"severity": "HIGH"
},
"details": "Microsoft Defender Denial of Service Vulnerability",
"id": "GHSA-qj2r-8848-46qg",
"modified": "2023-04-11T21:31:02Z",
"published": "2023-04-11T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24860"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GSD-2023-24860
Vulnerability from gsd - Updated: 2023-12-13 01:20Details
Microsoft Defender Denial of Service Vulnerability
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-24860",
"id": "GSD-2023-24860"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-24860"
],
"details": "Microsoft Defender Denial of Service Vulnerability",
"id": "GSD-2023-24860",
"modified": "2023-12-13T01:20:57.800666Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-24860",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Malware Protection Engine",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.1.0.0",
"version_value": "1.1.20200.4"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Microsoft Defender Denial of Service Vulnerability"
}
]
},
"impact": {
"cvss": [
{
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860",
"refsource": "MISC",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.20200.4",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-24860"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Microsoft Defender Denial of Service Vulnerability"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860",
"refsource": "MISC",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-04-19T13:47Z",
"publishedDate": "2023-04-11T21:15Z"
}
}
}
BDU:2023-02200
Vulnerability from fstec - Published: 11.04.2023
VLAI Severity ?
Title
Уязвимость Защитника Microsoft (Microsoft Defender) операционных систем Windows, позволяющая нарушителю вызвать отказ в обслуживании
Description
Уязвимость Защитника Microsoft (Microsoft Defender) операционных систем Windows связана с недостаточной проверкой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании путем передачи специально созданных данных
Severity ?
Vendor
Microsoft Corp
Software Name
Microsoft Malware Protection Engine
Software Version
до 1.1.20200.4 (Microsoft Malware Protection Engine)
Possible Mitigations
Использование рекомендаций производителя:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860
Reference
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860
https://www.cybersecurity-help.cz/vdb/SB2023041204
CWE
CWE-20
{
"CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 1.1.20200.4 (Microsoft Malware Protection Engine)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.04.2023",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "22.04.2023",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.04.2023",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-02200",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-24860",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Microsoft Malware Protection Engine",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0430 Microsoft (Microsoft Defender) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Windows, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0430 Microsoft (Microsoft Defender) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Windows \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u043f\u0443\u0442\u0435\u043c \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860\nhttps://www.cybersecurity-help.cz/vdb/SB2023041204",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}
WID-SEC-W-2023-0925
Vulnerability from csaf_certbund - Published: 2023-04-11 22:00 - Updated: 2023-04-11 22:00Summary
Microsoft Malware Protection Engine: Schwachstelle ermöglicht Denial of Service
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Die Malware Protection Engine ist Bestandteil verschiedener Sicherheitsprodukte von Microsoft und stellt selbigen das Scannen sowie Erkennen und Entfernen von Schadprogrammen zur Verfügung.
Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft Malware Protection Engine ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme: - Windows
Es existiert eine Schwachstelle in Microsoft Malware Protection Engine. Microsoft veröffentlicht keine weiteren Details zu dieser Schwachstelle. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuführen.
References
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Die Malware Protection Engine ist Bestandteil verschiedener Sicherheitsprodukte von Microsoft und stellt selbigen das Scannen sowie Erkennen und Entfernen von Schadprogrammen zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft Malware Protection Engine ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0925 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0925.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0925 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0925"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-04-11",
"url": "https://msrc.microsoft.com/update-guide"
}
],
"source_lang": "en-US",
"title": "Microsoft Malware Protection Engine: Schwachstelle erm\u00f6glicht Denial of Service",
"tracking": {
"current_release_date": "2023-04-11T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:48:32.631+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0925",
"initial_release_date": "2023-04-11T22:00:00.000+00:00",
"revision_history": [
{
"date": "2023-04-11T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Malware Protection Engine",
"product": {
"name": "Microsoft Malware Protection Engine",
"product_id": "T001207",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:malware_protection_engine:1.1.9506.0"
}
}
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-24860",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in Microsoft Malware Protection Engine. Microsoft ver\u00f6ffentlicht keine weiteren Details zu dieser Schwachstelle. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T001207"
]
},
"release_date": "2023-04-11T22:00:00.000+00:00",
"title": "CVE-2023-24860"
}
]
}
Loading…
Show additional events:
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…