سه‌شنبه، 19 اسفند، شرکت مایکروسافت (Microsoft Corp)، مجموعه‌اصلاحیه‌های امنیتی ماهانه خود را برای ماه میلادی مارس منتشر کرد. اصلاحیه‌های مذکور در مجموع 82 آسیب‌پذیری را در Windows و محصولات و اجزای نرم‌افزاری زیر ترمیم می‌کنند:
- Azure
- HEVC Video Extensions
- Internet Explorer
- Microsoft 365 Apps for Enterprise
- Microsoft Business Productivity Servers
- Microsoft Edge
- Microsoft Excel
- Microsoft Office
- Microsoft PowerPoint
- Microsoft Quantum Development Kit for Visual Studio Code
- Microsoft SharePoint
- Microsoft Visio
- Microsoft Visual Studio
- Power BI Report Server
- Visual Studio
درجه اهمیت 10 مورد از این آسیب‌پذیری‌ها “حیاتی” (Critical) و 72 مورد “مهم” (Important) اعلام شده است.
در این گزارش که با همکاری شرکت مهندسی شبکه گستر و مرکز مدیریت راهبردی افتای ریاست جمهوری تهیه شده به برخی از بااهیمت‌ترین اصلاحیه‌های ماه مارس مایکروسافت پرداخته شده است.
دو مورد از آسیب‌پذیری‌های ترمیم شده توسط این اصلاحیه‌ها، روز-صفر (Zero-day) بوده و جزییات آنها پیش‌تر به‌صورت عمومی منتشر شده بود. فهرست این آسیب‌پذیری‌های روز-صفر به شرح زیر است:
- CVE-2021-26411 که ضعفی از نوع Memory Corruption در مرورگر Internet Explorer است. هدایت کاربر به یک صفحه حاوی کد Exploit آن می‌تواند یکی از سناریوهای احتمالی سوءاستفاده از این آسیب‌پذیری باشد. نکته بسیار مهم این که حداقل از ماه فوریه گروهی از مهاجمان از آسیب‌پذیری مذکور به منظور نصب یک Backdoor سفارشی بر روی اهداف خود استفاده کرده‌اند.
- CVE-2021-27077 که ضعفی از Elevation of Privilege است که Win32k در سیستم عامل Windows متأثر می‌شود.
همچنین چندین آسیب‌پذیری در سرویس DNS سیستم عامل Windows توسط اصلاحیه‌های این ماه ترمیم شده‌اند. CVE-2021-26877، CVE-2021-26893، CVE-2021-26894، CVE-2021-26895 و CVE-2021-26897 در دسته از RCE و CVE-2021-27063 و CVE-2021-26896 در دسته آسیب‌پذیری‌های Denial of Service (از کاراندازی سرویس) قرار می‌گیرند.
لازم به ذکر است که 12 اسفند ماه شرکت مایکروسافت با انتشار به‌روزرسانی اضطراری و خارج از برنامه، چهار آسیب‌پذیری بحرانی روز-صفر را در نسخ مختلف Microsoft Exchange ترمیم کرد. جزییات بیشتر در خصوص این به‌روزرسانی‌ها در لینک زیر قابل مطالعه است:
به‌روزرسانی‌های 12 اسفند علاوه بر موارد بالا سه آسیب‌پذیری زیر را نیز که همگی از نوع RCE (اجرای کد به صورت از راه دور) هستند در Microsoft Exchange ترمیم می‌کنند:
فهرست کامل آسیب‌پذیری‌های ترمیم شده توسط مجموعه‌اصلاحیه‌های مارس ۲۰۲۱ مایکروسافت در جدول زیر قابل دریافت و مطالعه است.
|
محصول |
شناسه CVE |
شرح آسیب‌پذیری |
شدت حساسیت |
|
Application Virtualization |
Application Virtualization Remote Code Execution Vulnerability |
مهم |
|
|
Azure |
Azure Virtual Machine Information Disclosure Vulnerability |
مهم |
|
|
Azure Sphere |
Azure Sphere Unsigned Code Execution Vulnerability |
حیاتی |
|
|
Azure Sphere |
Azure Sphere Unsigned Code Execution Vulnerability |
حیاتی |
|
|
Internet Explorer |
Internet Explorer Remote Code Execution Vulnerability |
مهم |
|
|
Internet Explorer |
Internet Explorer Memory Corruption Vulnerability |
حیاتی |
|
|
Microsoft ActiveX |
Windows ActiveX Installer Service Information Disclosure Vulnerability |
مهم |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21173: Side-channel information leakage in Network Internals |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21172: Insufficient policy enforcement in File System API |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21169: Out of bounds memory access in V8 |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21170: Incorrect security UI in Loader |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21171: Incorrect security UI in TabStrip and Navigation |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21175: Inappropriate implementation in Site isolation |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21176: Inappropriate implementation in full screen mode |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21177: Insufficient policy enforcement in Autofill |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21174: Inappropriate implementation in Referrer |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21178 : Inappropriate implementation in Compositing |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21161: Heap buffer overflow in TabStrip |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21162: Use after free in WebRTC |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21160: Heap buffer overflow in WebAudio |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2020-27844: Heap buffer overflow in OpenJPEG |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21159: Heap buffer overflow in TabStrip |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21163: Insufficient data validation in Reader Mode |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21167: Use after free in bookmarks |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21168: Insufficient policy enforcement in appcache |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21166: Object lifecycle issue in audio |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21164: Insufficient data validation in Chrome for iOS |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21165: Object lifecycle issue in audio |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21189: Insufficient policy enforcement in payments |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21181: Side-channel information leakage in autofill |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21186: Insufficient policy enforcement in QR scanning |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21190 : Uninitialized Use in PDFium |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21183: Inappropriate implementation in performance APIs |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21185: Insufficient policy enforcement in extensions |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21187: Insufficient data validation in URL formatting |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21182: Insufficient policy enforcement in navigations |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21180: Use after free in tab search |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21184: Inappropriate implementation in performance APIs |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21179: Use after free in Network Internals |
– |
|
|
Microsoft Edge on Chromium |
Chromium CVE-2021-21188: Use after free in Blink |
– |
|
|
Microsoft Exchange Server |
Microsoft Exchange Server Remote Code Execution Vulnerability |
حیاتی |
|
|
Microsoft Exchange Server |
Microsoft Exchange Server Remote Code Execution Vulnerability |
حیاتی |
|
|
Microsoft Exchange Server |
Microsoft Exchange Server Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Exchange Server |
Microsoft Exchange Server Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Exchange Server |
Microsoft Exchange Server Remote Code Execution Vulnerability |
حیاتی |
|
|
Microsoft Exchange Server |
Microsoft Exchange Server Remote Code Execution Vulnerability |
حیاتی |
|
|
Microsoft Exchange Server |
Microsoft Exchange Server Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Graphics Component |
Windows Win32k Elevation of Privilege Vulnerability |
مهم |
|
|
Microsoft Graphics Component |
Windows Win32k Elevation of Privilege Vulnerability |
مهم |
|
|
Microsoft Graphics Component |
Windows Graphics Component Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Graphics Component |
OpenType Font Parsing Remote Code Execution Vulnerability |
حیاتی |
|
|
Microsoft Graphics Component |
Windows Win32k Elevation of Privilege Vulnerability |
مهم |
|
|
Microsoft Graphics Component |
Windows Graphics Component Elevation of Privilege Vulnerability |
مهم |
|
|
Microsoft Office |
Microsoft Office Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office |
Microsoft Office ClickToRun Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office |
Microsoft Office Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office Excel |
Microsoft Excel Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office Excel |
Microsoft Excel Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office Excel |
Microsoft Office Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office PowerPoint |
Microsoft PowerPoint Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office SharePoint |
Microsoft SharePoint Server Information Disclosure Vulnerability |
مهم |
|
|
Microsoft Office SharePoint |
Microsoft SharePoint Spoofing Vulnerability |
مهم |
|
|
Microsoft Office SharePoint |
Microsoft SharePoint Server Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Office Visio |
Microsoft Visio Security Feature Bypass Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
Windows Media Photo Codec Information Disclosure Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
حیاتی |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
حیاتی |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
مهم |
|
|
Microsoft Windows Codecs Library |
HEVC Video Extensions Remote Code Execution Vulnerability |
حیاتی |
|
|
Power BI |
Microsoft Power BI Information Disclosure Vulnerability |
مهم |
|
|
Role: DNS Server |
Windows DNS Server Denial of Service Vulnerability |
مهم |
|
|
Role: DNS Server |
Windows DNS Server Remote Code Execution Vulnerability |
مهم |
|
|
Role: DNS Server |
Windows DNS Server Remote Code Execution Vulnerability |
حیاتی |
|
|
Role: DNS Server |
Windows DNS Server Remote Code Execution Vulnerability |
مهم |
|
|
Role: DNS Server |
Windows DNS Server Remote Code Execution Vulnerability |
مهم |
|
|
Role: DNS Server |
Windows DNS Server Denial of Service Vulnerability |
مهم |
|
|
Role: DNS Server |
Windows DNS Server Remote Code Execution Vulnerability |
مهم |
|
|
Role: Hyper-V |
Windows Hyper-V Remote Code Execution Vulnerability |
حیاتی |
|
|
Role: Hyper-V |
Windows NAT Denial of Service Vulnerability |
مهم |
|
|
Visual Studio |
Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability |
مهم |
|
|
Visual Studio |
Git for Visual Studio Remote Code Execution Vulnerability |
حیاتی |
|
|
Visual Studio Code |
Visual Studio Code Remote Code Execution Vulnerability |
مهم |
|
|
Visual Studio Code |
Visual Studio Code ESLint Extension Remote Code Execution Vulnerability |
مهم |
|
|
Visual Studio Code |
Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability |
مهم |
|
|
Visual Studio Code |
Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability |
مهم |
|
|
Windows Admin Center |
Windows Admin Center Security Feature Bypass Vulnerability |
مهم |
|
|
Windows Container Execution Agent |
Windows Container Execution Agent Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Container Execution Agent |
Windows Container Execution Agent Elevation of Privilege Vulnerability |
مهم |
|
|
Windows DirectX |
DirectX Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Error Reporting |
Windows Error Reporting Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Event Tracing |
Windows Event Tracing Information Disclosure Vulnerability |
مهم |
|
|
Windows Event Tracing |
Windows Event Tracing Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Event Tracing |
Windows Event Tracing Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Event Tracing |
Windows Event Tracing Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Extensible Firmware Interface |
Windows Extensible Firmware Interface Security Feature Bypass Vulnerability |
مهم |
|
|
Windows Folder Redirection |
Microsoft Windows Folder Redirection Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Installer |
Windows Installer Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Media |
Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
مهم |
|
|
Windows Overlay Filter |
Windows Overlay Filter Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Overlay Filter |
Windows App-V Overlay Filter Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Print Spooler Components |
Windows Print Spooler Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Print Spooler Components |
Windows Print Spooler Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Projected File System Filter Driver |
Windows Projected File System Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Registry |
Windows Virtual Registry Provider Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Remote Access API |
Remote Access API Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Storage Spaces Controller |
Storage Spaces Controller Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Update Assistant |
Windows 10 Update Assistant Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Update Stack |
Windows Update Stack Setup Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Update Stack |
Windows Update Stack Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Update Stack |
Windows Update Service Elevation of Privilege Vulnerability |
مهم |
|
|
Windows UPnP Device Host |
Windows UPnP Device Host Elevation of Privilege Vulnerability |
مهم |
|
|
Windows User Profile Service |
Windows User Profile Service Elevation of Privilege Vulnerability |
مهم |
|
|
Windows User Profile Service |
User Profile Service Denial of Service Vulnerability |
مهم |
|
|
Windows WalletService |
Windows WalletService Elevation of Privilege Vulnerability |
مهم |
|
|
Windows WalletService |
Windows WalletService Elevation of Privilege Vulnerability |
مهم |
|
|
Windows Win32K |
Windows Win32k Elevation of Privilege Vulnerability |
مهم |