{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows 10 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for 32-bit systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for 32-bit Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for x64-based systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2021-07-02",
  "content": "## Solution\n\n**A ce jour, le correctif publi\u00e9 par Microsoft le 09 juin 2021 ne\nprot\u00e8ge pas le service spouleur d\u0027impression contre cette m\u00e9thode\nd\u0027exploitation.**\n\nCette section sera mise \u00e0 jour lorsque Microsoft publiera un nouveau\ncorrectif.\n",
  "cves": [
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    }
  ],
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 CERT-FR CERTFR-2021-AVI-448 du 09 juin 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-448/"
    }
  ],
  "reference": "CERTFR-2021-ALE-013",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-30T00:00:00.000000"
    },
    {
      "description": "ajout de premiers \u00e9l\u00e9ments d\u0027aide \u00e0 la d\u00e9tection",
      "revision_date": "2021-06-30T00:00:00.000000"
    },
    {
      "description": "Alerte remplac\u00e9e par l\u0027alerte CERTFR-2021-ALE-014",
      "revision_date": "2021-07-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u00a0\n\n\u003cstrong\u003e\\[version mise \u00e0 jour le 02 juillet 2021 : cette alerte est remplac\u00e9e\npar l\u0027alerte CERTFR-2021-ALE-014\\]  \n\u003c/strong\u003e\n\n\u003cstrong\u003eLa vuln\u00e9rabilit\u00e9 CVE-2021-1675 est correctement corrig\u00e9e par le\ncorrectif publi\u00e9 par l\u0027\u00e9diteur lors du Patch Tuesday de juin 2021. Les\ncodes d\u0027attaque publi\u00e9s le 29 juin exploitent une autre vuln\u00e9rabilit\u00e9 du\nspouleur d\u0027impression. Se r\u00e9f\u00e9rer \u00e0\n[https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-014](https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-014)\u003c/strong\u003e\n\n\u00a0\n\n\u003cstrong\u003e\\[version mise \u00e0 jour le 30 juin 2021 \u00e0 19h20 : ajout d\u0027informations\nd\u0027aide \u00e0 la d\u00e9tection\\]\u003c/strong\u003e\n\nLe 8 juin 2021, Microsoft publiait des correctifs concernant des\nvuln\u00e9rabilit\u00e9s critiques de type \u00ab\u00a0jour z\u00e9ro\u00a0\u00bb (*zero day*). Une de ces\nvuln\u00e9rabilit\u00e9s, la CVE-2021-1675, affecte le service spouleur\nd\u0027impression (*print spooler*), un composant logiciel du syst\u00e8me\nd\u2019exploitation Microsoft Windows activ\u00e9 par d\u00e9faut. Cette vuln\u00e9rabilit\u00e9\npermettait initialement, selon Microsoft, une escalade de privil\u00e8ges en\nlocal. Son score CVSSv3 s\u2019\u00e9levait alors \u00e0 7.8.\n\nLe 29 juin 2021, deux chercheurs ont pr\u00e9sent\u00e9 une nouvelle fa\u00e7on\nd\u2019exploiter cette vuln\u00e9rabilit\u00e9, cette fois \u00e0 distance et ce malgr\u00e9 le\ncorrectif propos\u00e9 par Microsoft. La CVE-2021-1675 doit donc \u00eatre\nconsid\u00e9r\u00e9e comme une vuln\u00e9rabilit\u00e9 non corrig\u00e9e permettant une ex\u00e9cution\nde code \u00e0 distance, entra\u00eenant une \u00e9l\u00e9vation de privil\u00e8ges avec les\ndroits SYSTEM. Son score CVSSv3 est donc amen\u00e9 \u00e0 \u00e9voluer.\n\n\u003cstrong\u003eDes codes d\u0027exploitation sont publiquement disponibles sur Internet\u003c/strong\u003e,\nce qui signifie que l\u2019exploitation de cette vuln\u00e9rabilit\u00e9 est imminente\nou d\u00e9j\u00e0 en cours.\n\nCes codes exploitent la possibilit\u00e9 offerte par le service\u00a0spouleur\nd\u0027impression (*print spooler)* de t\u00e9l\u00e9verser un pilote, dans le cadre de\nl\u2019ajout d\u2019une nouvelle imprimante, pour installer un code malveillant.\nOr, par d\u00e9faut, le service spouleur d\u0027impression (*print spooler)* est\nactiv\u00e9 sur les contr\u00f4les de domaine Active Directory. Un attaquant,\nayant pr\u00e9alablement compromis un poste utilisateur, pourra *in fine*\nobtenir les droits et privil\u00e8ges de l\u2019administrateur de domaine Active\nDirectory.\n\nAu vu de la criticit\u00e9 de cette vuln\u00e9rabilit\u00e9, l\u2019ANSSI recommande\nfortement de r\u00e9aliser les actions suivantes\u00a0:\n\n-   modifier imm\u00e9diatement le type de d\u00e9marrage vers la valeur\n    \"D\u00e9sactiv\u00e9\" / \"Disabled\" pour le service \"Spooler\" (description :\n    \"Spouleur d\u0027impression\" / \"Print Spooler\", ex\u00e9cutable :\n    \"spoolsv.exe\") sur les contr\u00f4leurs de domaine, ainsi que sur toute\n    autre machine sur lequel ce service n\u2019est pas n\u00e9cessaire,\n    particuli\u00e8rement pour des machines h\u00e9bergeant des services\n    privil\u00e9gi\u00e9s sur l\u0027Active Directory ;\n-   une fois le service d\u00e9sactiv\u00e9, il est n\u00e9cessaire d\u2019arr\u00eater\n    manuellement le service ou de red\u00e9marrer la machine\u00a0;\n-   de contr\u00f4ler le syst\u00e8me d\u2019information pour d\u00e9tecter d\u2019\u00e9ventuelles\n    lat\u00e9ralisations ainsi qu\u2019une compromission des serveurs Active\n    Directory.\n\n### Informations d\u0027aide \u00e0 la d\u00e9tection\n\n\u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\nclass=\"mx_EventTile_body\" dir=\"auto\"\u003eUne premi\u00e8re mesure de d\u00e9tection\nconsistera en la surveillance du processus *spoolsv.exe* sur les\nmachines sur lesquelles se processus ne peut pas \u00eatre d\u00e9sactiv\u00e9 (\\*). La\ncr\u00e9ation d\u0027un processus enfant qui lui serait rattach\u00e9 devrait faire\nl\u0027objet d\u0027une analyse. A cet effet, on peut surveiller ce type\nd\u0027\u00e9v\u00e8nement notamment via l\u0027\u00e9v\u00e8nement d\u0027identifiant 1 de l\u0027outil System\nMonitor (Sysmon) mais \u00e9galement par l\u0027\u00e9v\u00e8nement d\u0027identifiant 4688 des\njournaux de s\u00e9curit\u00e9 de Windows.\u003c/span\u003e\u003c/span\u003e\n\nCes \u00e9l\u00e9ments seront compl\u00e9t\u00e9s ult\u00e9rieurement.\n\n(\\*) Le CERT-FR recommande fortement de ne \u003cstrong\u003ejamais\u003c/strong\u003e activer le service\nspouleur d\u0027impression sur les contr\u00f4leurs de domaine.\n\n\u00a0\n",
  "title": "[MaJ] Vuln\u00e9rabilit\u00e9 dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": "2021-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-1675",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for 32-bit systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for 32-bit Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for x64-based systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2022-01-05",
  "content": "## Solution\n\n**\u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\nclass=\"mx_EventTile_body\" dir=\"auto\"\u003e\\[05 janvier 2022\\] La\nvuln\u00e9rabilit\u00e9 CVE-2021-36958 a \u00e9t\u00e9 corrig\u00e9e dans le Patch Tuesday de\nseptembre 2021 :\n\u003ca href=\"https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-710/\"\nclass=\"linkified\" rel=\"noreferrer nofollow noopener\"\ntarget=\"_blank\"\u003ehttps://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-710/.\u003c/a\u003e\u003c/span\u003e\u003c/span\u003e**\n\n**\\[16 juillet 2021\\] Le CERT-FR actualisera cette alerte lorsqu\u0027un\ncorrectif sera disponible pour la vuln\u00e9rabilit\u00e9 CVE-2021-36958.**\n\n**\\[11 ao\u00fbt 2021\\] Microsoft a publi\u00e9 un correctif pour la vuln\u00e9rabilit\u00e9\nCVE CVE-2021-34481.** Le CERT-FR recommande son installation dans les\nplus brefs d\u00e9lais.\n\n\u003cs\u003e**\\[16 juillet 2021\\] Le CERT-FR actualisera cette alerte lorsqu\u0027un\ncorrectif sera disponible pour la CVE CVE-2021-34481.**\u003c/s\u003e\n\n**\\[08 juillet 2021 14h30\\] Le CERT-FR recommande tr\u00e8s fortement\nd\u0027appliquer le correctif sans d\u00e9lai,** m\u00eame si celui-ci semble corriger\nuniquement l\u0027ex\u00e9cution de code arbitraire \u00e0 distance et non l\u0027escalade\nde privil\u00e8ge en local.\n\n**En outre, il est obligatoire de respecter la recommandation de\nl\u0027\u00e9diteur concernant la fonctionnalit\u00e9 \"*Point and Print*\"** en\ns\u0027assurant que, si les cl\u00e9s de registre existent (ce n\u0027est pas le cas\npar d\u00e9faut), celles-ci sont bien d\u00e9finies avec les valeurs suivantes :\n\n-   la cl\u00e9 de registre NoWarningNoElevationOnInstall\n    (HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\n    NT\\\\Printers\\\\PointAndPrint) doit \u00eatre absente ou \u00e9gale \u00e0 0 (DWORD)\n-   la cl\u00e9 de registre NoWarningNoElevationOnUpdate (m\u00eame emplacement)\n    doit \u00eatre absente ou \u00e9gale \u00e0 0 (DWORD)\n\n\u003cs\u003e**\\[06 juillet 2021\\]** L\u0027\u00e9diteur a publi\u00e9 des correctifs pour les\nversions maintenues de son syst\u00e8me d\u0027exploitation, \u00e0 l\u0027exception des\nversions Windows 2012 R2, Windows 2016 et Windows 10 Version 1607 pour\nlesquelles un correctif sera publi\u00e9 ult\u00e9rieurement.\u003c/s\u003e\n\n\u003cs\u003e**\\[08 juillet 2021\\]** Des correctifs sont d\u00e9sormais disponibles\npour toutes les versions maintenues de Microsoft Windows.\u003c/s\u003e\n\n**Important** : Il convient de noter que les versions qui ne sont plus\nmaintenues, telles que Windows 10 Version 1903, sont affect\u00e9es par la\nvuln\u00e9rabilit\u00e9 mais ne seront pas corrig\u00e9es.\n",
  "cves": [
    {
      "name": "CVE-2021-34481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34481"
    },
    {
      "name": "CVE-2021-36958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36958"
    },
    {
      "name": "CVE-2021-34527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34527"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    }
  ],
  "links": [
    {
      "title": "[6]",
      "url": "https://github.com/SigmaHQ/sigma/blob/7584471e2ae06d756751ca40556782fe6fd5981d/rules/windows/builtin/win_exploit_cve_2021_1675_printspooler_operational.yml"
    },
    {
      "title": "[5]",
      "url": "https://github.com/SigmaHQ/sigma/blob/b09efee0452e7be7773807d8761a83d7fc54e033/rules/windows/registry_event/sysmon_registry_susp_printer_driver.yml"
    },
    {
      "title": "Avis CERT-FR CERTFR-2021-AVI-506 du 07 juillet 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-506/"
    },
    {
      "title": "[8] Bulletin du CERT/CC VU#131152 du 18 juillet 2021",
      "url": "https://kb.cert.org/vuls/id/131152"
    },
    {
      "title": "[7]",
      "url": "https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872"
    },
    {
      "title": "[2] guide Microsoft 365 Defender",
      "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Exploits/Print%20Spooler%20RCE"
    },
    {
      "title": "[1] Points de contr\u00f4le Active Directory d\u00e9finis par l\u0027ANSSI",
      "url": "https://www.cert.ssi.gouv.fr/dur/CERTFR-2020-DUR-001/"
    },
    {
      "title": "Avis CERT-FR CERTFR-2021-AVI-618 du 11 ao\u00fbt 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-618/"
    }
  ],
  "reference": "CERTFR-2021-ALE-014",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-02T00:00:00.000000"
    },
    {
      "description": "Publication de correctifs pour la plupart des versions de Microsoft Windows",
      "revision_date": "2021-07-07T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027avis CERT-FR CERTFR-2021-AVI-506 du 07 juillet 2021.",
      "revision_date": "2021-07-07T00:00:00.000000"
    },
    {
      "description": "Publication de correctifs pour toutes les versions, recommandation \u00e9diteur suppl\u00e9mentaire",
      "revision_date": "2021-07-08T00:00:00.000000"
    },
    {
      "description": "Clarification des recommandations",
      "revision_date": "2021-07-08T00:00:00.000000"
    },
    {
      "description": "correction chemin ImageLoaded:C:WindowsSystem32spooldrivers",
      "revision_date": "2021-07-12T00:00:00.000000"
    },
    {
      "description": "D\u00e9claration d\u0027une nouvelle CVE et compl\u00e9ments d\u0027information sur la d\u00e9tection syst\u00e8me",
      "revision_date": "2021-07-16T00:00:00.000000"
    },
    {
      "description": "Mise \u00e0 jour de l\u0027avis de l\u0027\u00e9diteur avec correctifs.",
      "revision_date": "2021-08-11T00:00:00.000000"
    },
    {
      "description": "Modification du titre, ajout de la vuln\u00e9rabilit\u00e9 CVE-2021-36958",
      "revision_date": "2021-08-12T00:00:00.000000"
    },
    {
      "description": "Mention de la disponibilit\u00e9 du correctif pour la vuln\u00e9rabilit\u00e9 CVE-2021-36958.",
      "revision_date": "2022-01-05T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2022-01-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u003cstrong\u003e\\[version du 12 ao\u00fbt 2021\\]\u003c/strong\u003e\n\nLe 11 ao\u00fbt 2021, Microsoft a publi\u00e9 un avis concernant la\nvuln\u00e9rabilit\u00e9\u00a0CVE-2021-36958\u00a0affectant le spouleur d\u2019impression (*print\nspooler*). Microsoft indique que cette vuln\u00e9rabilit\u00e9 permet une\nex\u00e9cution de code arbitraire \u00e0 distance. Le CERT/CC ajoute qu\u0027en se\nconnectant \u00e0 une imprimante malveillante, l\u0027attaquant peut ex\u00e9cuter du\ncode arbitraire avec les privil\u00e8ges *SYSTEM* \\[8\\].\n\nAucun correctif n\u0027est disponible pour l\u0027instant. Microsoft conseille\ndonc de d\u00e9sactiver le service.\n\nComme la d\u00e9sactivation compl\u00e8te des impressions est difficilement\nr\u00e9alisable, le CERT-FR renvoie vers les recommandations formul\u00e9es dans\nle paragraphe \\[version initiale\\].\n\n\u003cstrong\u003e\\[version du 11 ao\u00fbt\\]\u003c/strong\u003e\n\nMicrosoft a publi\u00e9 une mise \u00e0 jour de s\u00e9curit\u00e9\n([KB5005652](https://support.microsoft.com/help/5005652)) corrigeant la\nvuln\u00e9rabilit\u00e9 r\u00e9f\u00e9renc\u00e9e par l\u0027identifiant CVE-2021-34481 \\[7\\]. \u003cstrong\u003ePoint\nimportant\u003c/strong\u003e : Microsoft a r\u00e9cemment pris connaissance d\u0027un \u003cstrong\u003esc\u00e9nario\nd\u0027attaque \u00e0 distance\u003c/strong\u003e pour cette vuln\u00e9rabilit\u00e9 dont l\u0027impact initial se\nrestreignait alors seulement \u00e0 une \u00e9l\u00e9vation de privil\u00e8ges locaux.\nAinsi, Microsoft a donc r\u00e9vis\u00e9 son \u00e9valuation en cons\u00e9quence. Le score\nCVSSv3 de cette vuln\u00e9rabilit\u00e9 s\u0027\u00e9l\u00e8ve maintenant \u00e0 8.8. Nous vous\nrecommandons d\u0027installer ces mises \u00e0 jour imm\u00e9diatement.\n\n\u003cstrong\u003e\\[version du 16 juillet, 15h30\\]\u003c/strong\u003e\n\nLe 6 juillet 2021, Microsoft annon\u00e7ait un correctif pour la\nCVE-2021-34527 afin de prot\u00e9ger les syst\u00e8mes Windows contre une attaque\ndistante. Cependant, le 15 juillet 2021, Microsoft a publi\u00e9 un\nbulletin de s\u00e9curit\u00e9 \\[3\\] qui confirme l\u0027existence d\u0027une vuln\u00e9rabilit\u00e9\n\u003cu\u003enon corrig\u00e9e\u003c/u\u003e permettant une \u00e9l\u00e9vation locale des privil\u00e8ges avec\nles privil\u00e8ges SYSTEM. Cette vuln\u00e9rabilit\u00e9 est r\u00e9f\u00e9renc\u00e9e par\nl\u0027identifiant CVE-2021-34481 \\[4\\]. L\u0027attaquant exploite la\nvuln\u00e9rabilit\u00e9 en acc\u00e9dant au syst\u00e8me cible localement. Il peut \u00e9galement\ns\u0027appuyer sur une interaction avec l\u0027utilisateur pour effectuer les\nactions requises afin d\u0027exploiter la vuln\u00e9rabilit\u00e9 (ex. : inciter un\nutilisateur l\u00e9gitime \u00e0 ouvrir un document malveillant).\n\n\u003cstrong\u003eLe CERT-FR rappelle que les recommandations ci-dessous sont toujours\nvalables. Par ailleurs, des compl\u00e9ments d\u0027aide \u00e0 la d\u00e9tection ont \u00e9t\u00e9\najout\u00e9s ci-apr\u00e8s.\u003c/strong\u003e\n\n\u00a0\n\n\u00a0\n\n\u003cstrong\u003e\\[version du 12 juillet, 15h30\\]\u003c/strong\u003e Correction d\u0027une erreur dans le nom\ndu chemin \"C:\\\\Windows\\\\System32\\\\spool\\\\drivers\", il s\u0027agit bien de\n\"drivers\" et non pas \"driver\".\n\n\u003cstrong\u003e\\[version du 08 juillet 2021 14h30\\]\u003c/strong\u003e Le correctif publi\u00e9 par\nMicrosoft ainsi que la s\u00e9curisation de la fonctionnalit\u00e9 \"Point and\nPrint\" (d\u00e9crite ci-dessous) permettent de se pr\u00e9munir contre une\nex\u00e9cution de code arbitraire \u00e0 distance. L\u0027application de ces mesures\npermet d\u0027envisager la r\u00e9activation de l\u0027impression distante sur les\nserveurs d\u0027impression (cf. ci-dessous).\n\n\u003cstrong\u003e\\[version du 08 juillet 2021 09h00 : information concernant la\npublication des correctifs, ajout d\u0027une recommandation de l\u0027\u00e9diteur\\]\u003c/strong\u003e\nvoir ci-dessous.\u003cstrong\u003e  \n\u003c/strong\u003e\n\n\u003cstrong\u003e\\[version du 07 juillet 2021 10h00 : information concernant la\npublication des correctifs\\]\u003c/strong\u003e se r\u00e9f\u00e9rer \u00e0 la section \"Solution\".\n\n\u00a0\n\n\u003cstrong\u003e\\[version initiale\\]\u003c/strong\u003e\n\n\u003cstrong\u003eCette alerte annule et remplace l\u2019alerte CERT-FR\nCERTFR-2021-ALE-013.\u003c/strong\u003e\n\nLe 29 juin 2021, deux chercheurs ont pr\u00e9sent\u00e9 une fa\u00e7on d\u2019exploiter une\nvuln\u00e9rabilit\u00e9 affectant le spouleur d\u2019impression (*print spooler*) et\npermettant une ex\u00e9cution de code \u00e0 distance, entra\u00eenant une \u00e9l\u00e9vation de\nprivil\u00e8ges avec les droits SYSTEM.\n\nLe 1\u003csup\u003eer\u003c/sup\u003e juillet 2021, Microsoft a publi\u00e9 un avis de s\u00e9curit\u00e9 indiquant\nque cette vuln\u00e9rabilit\u00e9 \u00ab\u00a0jour z\u00e9ro\u00a0\u00bb (*zero day*) est diff\u00e9rente de la\nvuln\u00e9rabilit\u00e9 CVE-2021-1675 initialement corrig\u00e9e lors du Patch Tuesday\ndu 09 juin 2021.\n\nCette nouvelle vuln\u00e9rabilit\u00e9, CVE-2021-34527, affecte le spouleur\nd\u2019impression (*print spooler*) qui est un composant du syst\u00e8me\nd\u2019exploitation Windows activ\u00e9 par d\u00e9faut. Elle permet \u00e0 un attaquant\nd\u2019ex\u00e9cuter du code arbitraire \u00e0 distance avec les droits SYSTEM.\n\n\u003cstrong\u003eDes codes d\u0027exploitation sont publiquement disponibles sur Internet\u003c/strong\u003e,\nce qui signifie que l\u2019exploitation de cette vuln\u00e9rabilit\u00e9 est imminente\nou d\u00e9j\u00e0 en cours.\n\nCes codes exploitent la possibilit\u00e9 offerte par le service\u00a0spouleur\nd\u0027impression de t\u00e9l\u00e9verser un pilote, dans le cadre de l\u2019ajout d\u2019une\nnouvelle imprimante, pour installer un code malveillant. \u003cstrong\u003eCe service\n\u00e9tant activ\u00e9 par d\u00e9faut, tout syst\u00e8me Windows est donc actuellement\nvuln\u00e9rable, avec la possibilit\u00e9 d\u0027une exploitation \u00e0 distance.\u003c/strong\u003e\n\nEn particulier, au sein d\u0027un syst\u00e8me d\u0027information Microsoft, les\ncontr\u00f4leurs de domaine Active Directory sont particuli\u00e8rement expos\u00e9s,\npuisqu\u0027un attaquant, ayant pr\u00e9alablement compromis un poste utilisateur,\npourra *in fine* obtenir les droits et privil\u00e8ges de niveau\n\"administrateur de domaine\" Active Directory.\n\n\u003cstrong\u003eL\u2019ANSSI recommande fortement de r\u00e9aliser les actions suivantes\u00a0:\u003c/strong\u003e\n\n-   pour tous les syst\u00e8mes ne n\u00e9cessitant pas le service d\u0027impression,\n    en particulier pour les contr\u00f4leurs de domaine (le CERT-FR\n    recommande fortement de ne \u003cu\u003ejamais activer\u003c/u\u003e le service spouleur\n    d\u0027impression sur les contr\u00f4leurs de domaine) :\n    -   modifier le type de d\u00e9marrage vers la valeur \"D\u00e9sactiv\u00e9\" /\n        \"Disabled\" pour le service \"Spooler\" (description : \"Spouleur\n        d\u0027impression\" / \"Print Spooler\", ex\u00e9cutable : \"spoolsv.exe\"),\n    -   une fois le service d\u00e9sactiv\u00e9, il est n\u00e9cessaire d\u2019arr\u00eater\n        manuellement le service ou de red\u00e9marrer la machine\u00a0;\n-   appliquer une politique de filtrage r\u00e9seau afin d\u0027\u00e9viter les\n    lat\u00e9ralisations sur les syst\u00e8mes n\u00e9cessitant le service d\u0027impression\n    (notamment les postes de travail) : on pourra notamment utiliser le\n    pare-feu int\u00e9gr\u00e9 pour interdire les connexions entrantes sur les\n    ports 445 et 139 (canaux nomm\u00e9s SMB) ainsi qu\u0027interdire les\n    connexions \u00e0 destination du processus spoolsv.exe ;\n-   \u003cstrong\u003e\\[08 juillet 2021 14h30\\]\u003c/strong\u003e \u003cu\u003esur les \u00e9quipements non corrig\u00e9s ou\n    qui ne sont pas des serveurs d\u0027impression\u003c/u\u003e, d\u00e9sactiver la prise\n    en compte des demandes d\u2019impression distante \u003cs\u003esur l\u2019ensemble des\n    syst\u00e8mes\u003c/s\u003e, tout en laissant la possibilit\u00e9 de lancer une\n    impression locale. Ce param\u00e8tre peut \u00eatre d\u00e9fini \u00e0 l\u2019aide d\u2019une\n    Strat\u00e9gie de Groupe (*Group Policy*)\u00a0: le param\u00e8tre \u00ab\u00a0Autoriser le\n    spouleur d\u2019impression \u00e0 accepter les connexions des clients\u00a0\u00bb doit\n    \u00eatre \u00e0 l\u2019\u00e9tat \u00ab\u00a0D\u00e9sactiv\u00e9\u00a0\u00bb/\u00ab\u00a0Disabled\u00a0\u00bb (\u00ab\u00a0Configuration\n    ordinateur\u00a0\u00bb / \u00abMod\u00e8le d\u2019administration\u00a0\u00bb / \u00ab\u00a0Imprimantes\u00a0\u00bb) ;\n-   mettre en place une d\u00e9tection syst\u00e8me et r\u00e9seau dans le but de\n    d\u00e9tecter les exploitations sur les \u00e9quipements vuln\u00e9rables, les\n    \u00e9ventuelles lat\u00e9ralisations ainsi que la compromission des contr\u00f4les\n    de domaine Active Directory ;\n-   suivre les recommandations de s\u00e9curisation d\u0027Active Directory \\[1\\].\n\n### Informations d\u0027aide \u00e0 la d\u00e9tection syst\u00e8me\n\nUne premi\u00e8re mesure de d\u00e9tection des codes d\u0027exploitation actuels\nconsistera en la surveillance des processus enfant cr\u00e9\u00e9s par le\nprocessus *spoolsv.exe*, les codes d\u0027exploitation utilisant cette\ntechnique pour ex\u00e9cuter un code malveillant. Pour tracer la cr\u00e9ation\nd\u0027un processus fils, on peut regarder les \u00e9v\u00e8nements suivants :\n\n-   l\u0027\u00e9v\u00e8nement num\u00e9ro 4688 du fournisseur\n    \"Microsoft-Windows-Security-Auditing\" enregistr\u00e9 dans le journal de\n    s\u00e9curit\u00e9, si la strat\u00e9gie est configur\u00e9e pour le g\u00e9n\u00e9rer car cet\n    \u00e9v\u00e8nement n\u0027est pas produit par d\u00e9faut ;\n-   l\u0027\u00e9v\u00e8nement num\u00e9ro 1 du fournisseur \"Microsoft-Windows-Sysmon\"\n    enregistr\u00e9 dans le journal sysmon si l\u0027outil System Monitor est\n    install\u00e9.\n\nIl convient de noter que les moyens de d\u00e9tection ci-dessus sont\npertinents dans le cadre de la d\u00e9tection d\u0027une exploitation \u00e0 l\u0027aide des\ncodes publi\u00e9s le 29 juin 2021.\n\nEn compl\u00e9ment, il pourrait \u00eatre utile de tracer\u00a0:\n\n-   l\u2019\u00e9v\u00e8nement num\u00e9ro 11 du fournisseur\n    \"Microsoft-Windows-Security-Mitigations/KernelMode\", qui pourra \u00eatre\n    utilis\u00e9 afin d\u2019identifier le chargement d\u2019une biblioth\u00e8que dynamique\n    (*dll*) non sign\u00e9e (champs SignatureLevel et ImageName) par le\n    processus spoolsv.exe\n    (\u00ab\u00a0ProcessPath:\\*\\\\Windows\\\\System32\\\\spoolsv.exe\u00a0\u00bb).\n-   l\u2019\u00e9v\u00e8nement num\u00e9ro 7 du fournisseur\n    \"Microsoft-Windows-Sysmon/Operational\" avec une configuration\n    appropri\u00e9e de System Monitor pour identifier le chargement de\n    biblioth\u00e8que (*dll*) par le processus spoolsv.exe\n    (\"Image:\\\\C:\\\\Windows\\\\System32\\\\spoolsv.exe\") depuis le r\u00e9pertoire\n    de pilote (champ\n    \"ImageLoaded:C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\\\*\") avec le\n    champ \"Signed\" \u00e0 false\n-   \u003cstrong\u003e\\[16 juillet 2021\\]\u003c/strong\u003e L\u2019\u00e9v\u00e8nement num\u00e9ro 808 du fournisseur\n    \"Microsoft-Windows-PrintService/Admin\" indique qu\u0027une erreur est\n    survenue lors du chargement d\u0027un pilote (le chemin de la dll est\n    mentionn\u00e9 par le champ PluginDllName). Un nom peu commun peut \u00eatre\n    consid\u00e9r\u00e9 comme un marqueur. Note: l\u0027enregistrement de cet \u00e9v\u00e8nement\n    est activ\u00e9 par d\u00e9faut.\n-   \u003cstrong\u003e\\[16 juillet 2021\\]\u003c/strong\u003e Certaines valeurs non usuelles remont\u00e9es par\n    l\u2019\u00e9v\u00e8nement num\u00e9ro 13 du fournisseur\n    \"Microsoft-Windows-Sysmon/Operational\" peuvent indiquer une\n    exploitation. Par exemple : DriverVersion=0.0.0.0,\n    DriverDate=01/01/1601 ou encore Manufacturer=(Empty). L\u0027installation\n    d\u0027un pilote d\u0027imprimante avec une valeur \"Manufacturer\" vide est une\n    action devant \u00eatre consid\u00e9r\u00e9e comme suspecte. De plus, si les cl\u00e9s\n    \"*Configuration File*\" et \"*Data File*\" contiennent la m\u00eame valeur,\n    cela peut-\u00eatre consid\u00e9r\u00e9 comme une exploitation r\u00e9ussie. Note : la\n    configuration doit \u00eatre modifi\u00e9e pour surveiller les modifications\n    de registre dans\n    *HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Environments\\\\Windows\n    x64\\\\Drivers\\\\Version-\\** par spoolsv.exe. Une r\u00e8gle Sigma peut \u00eatre\n    consult\u00e9e en suivant le lien \\[5\\].\n-   \u003cstrong\u003e\\[16 juillet 2021\\]\u003c/strong\u003e Les codes d\u0027exploitation publiques montrent\n    un caract\u00e8re d\u00e9terministe permettant une mise en d\u00e9tection \u00e0 l\u0027aide\n    de l\u2019\u00e9v\u00e8nement num\u00e9ro 316 du fournisseur\n    \"Microsoft-Windows-PrintService/Operational\". En effet, le champs\n    *Param1* contient le nom du driver (1234, Mimikatz\u2026) et le champs\n    *Param4* les valeurs de *pDriverPath*, *pConfigFile*, *pDataFile*.\n    On s\u2019int\u00e9ressera particuli\u00e8rement \u00e0 une valeur suspecte de\n    *pDataFile* ou de *Param1*. Quand l\u0027exploitation est r\u00e9ussie,\n    *pConfigFile* et *pDataFile* ont la m\u00eame valeur : la DLL\n    malveillante. Note : cet \u00e9v\u00e8nement n\u0027est pas activ\u00e9 par d\u00e9faut, il\n    s\u0027active de la fa\u00e7on suivante : *wevtutil.exe sl\n    \"Microsoft-Windows-PrintService/Operational\" /e:True*. Une r\u00e8gle\n    Sigma peut \u00eatre consult\u00e9e en suivant le lien \\[6\\].\n\nEnfin, l\u2019\u00e9diteur met \u00e0 disposition un ensemble d\u2019informations pour les\nutilisateurs de la solution Microsoft 365 Defender \\[2\\].\n",
  "title": "[MaJ] Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": "2021-07-15",
      "title": "[3] Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-34481",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481"
    },
    {
      "published_at": "2021-08-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-36958",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958"
    },
    {
      "published_at": "2021-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-34527",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows 10 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for 32-bit systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for 32-bit Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for x64-based systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2021-07-02",
  "content": "## Solution\n\n**A ce jour, le correctif publi\u00e9 par Microsoft le 09 juin 2021 ne\nprot\u00e8ge pas le service spouleur d\u0027impression contre cette m\u00e9thode\nd\u0027exploitation.**\n\nCette section sera mise \u00e0 jour lorsque Microsoft publiera un nouveau\ncorrectif.\n",
  "cves": [
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    }
  ],
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 CERT-FR CERTFR-2021-AVI-448 du 09 juin 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-448/"
    }
  ],
  "reference": "CERTFR-2021-ALE-013",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-30T00:00:00.000000"
    },
    {
      "description": "ajout de premiers \u00e9l\u00e9ments d\u0027aide \u00e0 la d\u00e9tection",
      "revision_date": "2021-06-30T00:00:00.000000"
    },
    {
      "description": "Alerte remplac\u00e9e par l\u0027alerte CERTFR-2021-ALE-014",
      "revision_date": "2021-07-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u00a0\n\n\u003cstrong\u003e\\[version mise \u00e0 jour le 02 juillet 2021 : cette alerte est remplac\u00e9e\npar l\u0027alerte CERTFR-2021-ALE-014\\]  \n\u003c/strong\u003e\n\n\u003cstrong\u003eLa vuln\u00e9rabilit\u00e9 CVE-2021-1675 est correctement corrig\u00e9e par le\ncorrectif publi\u00e9 par l\u0027\u00e9diteur lors du Patch Tuesday de juin 2021. Les\ncodes d\u0027attaque publi\u00e9s le 29 juin exploitent une autre vuln\u00e9rabilit\u00e9 du\nspouleur d\u0027impression. Se r\u00e9f\u00e9rer \u00e0\n[https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-014](https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-014)\u003c/strong\u003e\n\n\u00a0\n\n\u003cstrong\u003e\\[version mise \u00e0 jour le 30 juin 2021 \u00e0 19h20 : ajout d\u0027informations\nd\u0027aide \u00e0 la d\u00e9tection\\]\u003c/strong\u003e\n\nLe 8 juin 2021, Microsoft publiait des correctifs concernant des\nvuln\u00e9rabilit\u00e9s critiques de type \u00ab\u00a0jour z\u00e9ro\u00a0\u00bb (*zero day*). Une de ces\nvuln\u00e9rabilit\u00e9s, la CVE-2021-1675, affecte le service spouleur\nd\u0027impression (*print spooler*), un composant logiciel du syst\u00e8me\nd\u2019exploitation Microsoft Windows activ\u00e9 par d\u00e9faut. Cette vuln\u00e9rabilit\u00e9\npermettait initialement, selon Microsoft, une escalade de privil\u00e8ges en\nlocal. Son score CVSSv3 s\u2019\u00e9levait alors \u00e0 7.8.\n\nLe 29 juin 2021, deux chercheurs ont pr\u00e9sent\u00e9 une nouvelle fa\u00e7on\nd\u2019exploiter cette vuln\u00e9rabilit\u00e9, cette fois \u00e0 distance et ce malgr\u00e9 le\ncorrectif propos\u00e9 par Microsoft. La CVE-2021-1675 doit donc \u00eatre\nconsid\u00e9r\u00e9e comme une vuln\u00e9rabilit\u00e9 non corrig\u00e9e permettant une ex\u00e9cution\nde code \u00e0 distance, entra\u00eenant une \u00e9l\u00e9vation de privil\u00e8ges avec les\ndroits SYSTEM. Son score CVSSv3 est donc amen\u00e9 \u00e0 \u00e9voluer.\n\n\u003cstrong\u003eDes codes d\u0027exploitation sont publiquement disponibles sur Internet\u003c/strong\u003e,\nce qui signifie que l\u2019exploitation de cette vuln\u00e9rabilit\u00e9 est imminente\nou d\u00e9j\u00e0 en cours.\n\nCes codes exploitent la possibilit\u00e9 offerte par le service\u00a0spouleur\nd\u0027impression (*print spooler)* de t\u00e9l\u00e9verser un pilote, dans le cadre de\nl\u2019ajout d\u2019une nouvelle imprimante, pour installer un code malveillant.\nOr, par d\u00e9faut, le service spouleur d\u0027impression (*print spooler)* est\nactiv\u00e9 sur les contr\u00f4les de domaine Active Directory. Un attaquant,\nayant pr\u00e9alablement compromis un poste utilisateur, pourra *in fine*\nobtenir les droits et privil\u00e8ges de l\u2019administrateur de domaine Active\nDirectory.\n\nAu vu de la criticit\u00e9 de cette vuln\u00e9rabilit\u00e9, l\u2019ANSSI recommande\nfortement de r\u00e9aliser les actions suivantes\u00a0:\n\n-   modifier imm\u00e9diatement le type de d\u00e9marrage vers la valeur\n    \"D\u00e9sactiv\u00e9\" / \"Disabled\" pour le service \"Spooler\" (description :\n    \"Spouleur d\u0027impression\" / \"Print Spooler\", ex\u00e9cutable :\n    \"spoolsv.exe\") sur les contr\u00f4leurs de domaine, ainsi que sur toute\n    autre machine sur lequel ce service n\u2019est pas n\u00e9cessaire,\n    particuli\u00e8rement pour des machines h\u00e9bergeant des services\n    privil\u00e9gi\u00e9s sur l\u0027Active Directory ;\n-   une fois le service d\u00e9sactiv\u00e9, il est n\u00e9cessaire d\u2019arr\u00eater\n    manuellement le service ou de red\u00e9marrer la machine\u00a0;\n-   de contr\u00f4ler le syst\u00e8me d\u2019information pour d\u00e9tecter d\u2019\u00e9ventuelles\n    lat\u00e9ralisations ainsi qu\u2019une compromission des serveurs Active\n    Directory.\n\n### Informations d\u0027aide \u00e0 la d\u00e9tection\n\n\u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\nclass=\"mx_EventTile_body\" dir=\"auto\"\u003eUne premi\u00e8re mesure de d\u00e9tection\nconsistera en la surveillance du processus *spoolsv.exe* sur les\nmachines sur lesquelles se processus ne peut pas \u00eatre d\u00e9sactiv\u00e9 (\\*). La\ncr\u00e9ation d\u0027un processus enfant qui lui serait rattach\u00e9 devrait faire\nl\u0027objet d\u0027une analyse. A cet effet, on peut surveiller ce type\nd\u0027\u00e9v\u00e8nement notamment via l\u0027\u00e9v\u00e8nement d\u0027identifiant 1 de l\u0027outil System\nMonitor (Sysmon) mais \u00e9galement par l\u0027\u00e9v\u00e8nement d\u0027identifiant 4688 des\njournaux de s\u00e9curit\u00e9 de Windows.\u003c/span\u003e\u003c/span\u003e\n\nCes \u00e9l\u00e9ments seront compl\u00e9t\u00e9s ult\u00e9rieurement.\n\n(\\*) Le CERT-FR recommande fortement de ne \u003cstrong\u003ejamais\u003c/strong\u003e activer le service\nspouleur d\u0027impression sur les contr\u00f4leurs de domaine.\n\n\u00a0\n",
  "title": "[MaJ] Vuln\u00e9rabilit\u00e9 dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": "2021-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-1675",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for 32-bit systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for 32-bit Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 for x64-based systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for x64-based Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 for x64-based Systems Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 for 32-bit Systems Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 for 32-bit Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 for x64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 for ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2022-01-05",
  "content": "## Solution\n\n**\u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\nclass=\"mx_EventTile_body\" dir=\"auto\"\u003e\\[05 janvier 2022\\] La\nvuln\u00e9rabilit\u00e9 CVE-2021-36958 a \u00e9t\u00e9 corrig\u00e9e dans le Patch Tuesday de\nseptembre 2021 :\n\u003ca href=\"https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-710/\"\nclass=\"linkified\" rel=\"noreferrer nofollow noopener\"\ntarget=\"_blank\"\u003ehttps://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-710/.\u003c/a\u003e\u003c/span\u003e\u003c/span\u003e**\n\n**\\[16 juillet 2021\\] Le CERT-FR actualisera cette alerte lorsqu\u0027un\ncorrectif sera disponible pour la vuln\u00e9rabilit\u00e9 CVE-2021-36958.**\n\n**\\[11 ao\u00fbt 2021\\] Microsoft a publi\u00e9 un correctif pour la vuln\u00e9rabilit\u00e9\nCVE CVE-2021-34481.** Le CERT-FR recommande son installation dans les\nplus brefs d\u00e9lais.\n\n\u003cs\u003e**\\[16 juillet 2021\\] Le CERT-FR actualisera cette alerte lorsqu\u0027un\ncorrectif sera disponible pour la CVE CVE-2021-34481.**\u003c/s\u003e\n\n**\\[08 juillet 2021 14h30\\] Le CERT-FR recommande tr\u00e8s fortement\nd\u0027appliquer le correctif sans d\u00e9lai,** m\u00eame si celui-ci semble corriger\nuniquement l\u0027ex\u00e9cution de code arbitraire \u00e0 distance et non l\u0027escalade\nde privil\u00e8ge en local.\n\n**En outre, il est obligatoire de respecter la recommandation de\nl\u0027\u00e9diteur concernant la fonctionnalit\u00e9 \"*Point and Print*\"** en\ns\u0027assurant que, si les cl\u00e9s de registre existent (ce n\u0027est pas le cas\npar d\u00e9faut), celles-ci sont bien d\u00e9finies avec les valeurs suivantes :\n\n-   la cl\u00e9 de registre NoWarningNoElevationOnInstall\n    (HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\n    NT\\\\Printers\\\\PointAndPrint) doit \u00eatre absente ou \u00e9gale \u00e0 0 (DWORD)\n-   la cl\u00e9 de registre NoWarningNoElevationOnUpdate (m\u00eame emplacement)\n    doit \u00eatre absente ou \u00e9gale \u00e0 0 (DWORD)\n\n\u003cs\u003e**\\[06 juillet 2021\\]** L\u0027\u00e9diteur a publi\u00e9 des correctifs pour les\nversions maintenues de son syst\u00e8me d\u0027exploitation, \u00e0 l\u0027exception des\nversions Windows 2012 R2, Windows 2016 et Windows 10 Version 1607 pour\nlesquelles un correctif sera publi\u00e9 ult\u00e9rieurement.\u003c/s\u003e\n\n\u003cs\u003e**\\[08 juillet 2021\\]** Des correctifs sont d\u00e9sormais disponibles\npour toutes les versions maintenues de Microsoft Windows.\u003c/s\u003e\n\n**Important** : Il convient de noter que les versions qui ne sont plus\nmaintenues, telles que Windows 10 Version 1903, sont affect\u00e9es par la\nvuln\u00e9rabilit\u00e9 mais ne seront pas corrig\u00e9es.\n",
  "cves": [
    {
      "name": "CVE-2021-34481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34481"
    },
    {
      "name": "CVE-2021-36958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36958"
    },
    {
      "name": "CVE-2021-34527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34527"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    }
  ],
  "links": [
    {
      "title": "[6]",
      "url": "https://github.com/SigmaHQ/sigma/blob/7584471e2ae06d756751ca40556782fe6fd5981d/rules/windows/builtin/win_exploit_cve_2021_1675_printspooler_operational.yml"
    },
    {
      "title": "[5]",
      "url": "https://github.com/SigmaHQ/sigma/blob/b09efee0452e7be7773807d8761a83d7fc54e033/rules/windows/registry_event/sysmon_registry_susp_printer_driver.yml"
    },
    {
      "title": "Avis CERT-FR CERTFR-2021-AVI-506 du 07 juillet 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-506/"
    },
    {
      "title": "[8] Bulletin du CERT/CC VU#131152 du 18 juillet 2021",
      "url": "https://kb.cert.org/vuls/id/131152"
    },
    {
      "title": "[7]",
      "url": "https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872"
    },
    {
      "title": "[2] guide Microsoft 365 Defender",
      "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Exploits/Print%20Spooler%20RCE"
    },
    {
      "title": "[1] Points de contr\u00f4le Active Directory d\u00e9finis par l\u0027ANSSI",
      "url": "https://www.cert.ssi.gouv.fr/dur/CERTFR-2020-DUR-001/"
    },
    {
      "title": "Avis CERT-FR CERTFR-2021-AVI-618 du 11 ao\u00fbt 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-618/"
    }
  ],
  "reference": "CERTFR-2021-ALE-014",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-02T00:00:00.000000"
    },
    {
      "description": "Publication de correctifs pour la plupart des versions de Microsoft Windows",
      "revision_date": "2021-07-07T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027avis CERT-FR CERTFR-2021-AVI-506 du 07 juillet 2021.",
      "revision_date": "2021-07-07T00:00:00.000000"
    },
    {
      "description": "Publication de correctifs pour toutes les versions, recommandation \u00e9diteur suppl\u00e9mentaire",
      "revision_date": "2021-07-08T00:00:00.000000"
    },
    {
      "description": "Clarification des recommandations",
      "revision_date": "2021-07-08T00:00:00.000000"
    },
    {
      "description": "correction chemin ImageLoaded:C:WindowsSystem32spooldrivers",
      "revision_date": "2021-07-12T00:00:00.000000"
    },
    {
      "description": "D\u00e9claration d\u0027une nouvelle CVE et compl\u00e9ments d\u0027information sur la d\u00e9tection syst\u00e8me",
      "revision_date": "2021-07-16T00:00:00.000000"
    },
    {
      "description": "Mise \u00e0 jour de l\u0027avis de l\u0027\u00e9diteur avec correctifs.",
      "revision_date": "2021-08-11T00:00:00.000000"
    },
    {
      "description": "Modification du titre, ajout de la vuln\u00e9rabilit\u00e9 CVE-2021-36958",
      "revision_date": "2021-08-12T00:00:00.000000"
    },
    {
      "description": "Mention de la disponibilit\u00e9 du correctif pour la vuln\u00e9rabilit\u00e9 CVE-2021-36958.",
      "revision_date": "2022-01-05T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2022-01-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u003cstrong\u003e\\[version du 12 ao\u00fbt 2021\\]\u003c/strong\u003e\n\nLe 11 ao\u00fbt 2021, Microsoft a publi\u00e9 un avis concernant la\nvuln\u00e9rabilit\u00e9\u00a0CVE-2021-36958\u00a0affectant le spouleur d\u2019impression (*print\nspooler*). Microsoft indique que cette vuln\u00e9rabilit\u00e9 permet une\nex\u00e9cution de code arbitraire \u00e0 distance. Le CERT/CC ajoute qu\u0027en se\nconnectant \u00e0 une imprimante malveillante, l\u0027attaquant peut ex\u00e9cuter du\ncode arbitraire avec les privil\u00e8ges *SYSTEM* \\[8\\].\n\nAucun correctif n\u0027est disponible pour l\u0027instant. Microsoft conseille\ndonc de d\u00e9sactiver le service.\n\nComme la d\u00e9sactivation compl\u00e8te des impressions est difficilement\nr\u00e9alisable, le CERT-FR renvoie vers les recommandations formul\u00e9es dans\nle paragraphe \\[version initiale\\].\n\n\u003cstrong\u003e\\[version du 11 ao\u00fbt\\]\u003c/strong\u003e\n\nMicrosoft a publi\u00e9 une mise \u00e0 jour de s\u00e9curit\u00e9\n([KB5005652](https://support.microsoft.com/help/5005652)) corrigeant la\nvuln\u00e9rabilit\u00e9 r\u00e9f\u00e9renc\u00e9e par l\u0027identifiant CVE-2021-34481 \\[7\\]. \u003cstrong\u003ePoint\nimportant\u003c/strong\u003e : Microsoft a r\u00e9cemment pris connaissance d\u0027un \u003cstrong\u003esc\u00e9nario\nd\u0027attaque \u00e0 distance\u003c/strong\u003e pour cette vuln\u00e9rabilit\u00e9 dont l\u0027impact initial se\nrestreignait alors seulement \u00e0 une \u00e9l\u00e9vation de privil\u00e8ges locaux.\nAinsi, Microsoft a donc r\u00e9vis\u00e9 son \u00e9valuation en cons\u00e9quence. Le score\nCVSSv3 de cette vuln\u00e9rabilit\u00e9 s\u0027\u00e9l\u00e8ve maintenant \u00e0 8.8. Nous vous\nrecommandons d\u0027installer ces mises \u00e0 jour imm\u00e9diatement.\n\n\u003cstrong\u003e\\[version du 16 juillet, 15h30\\]\u003c/strong\u003e\n\nLe 6 juillet 2021, Microsoft annon\u00e7ait un correctif pour la\nCVE-2021-34527 afin de prot\u00e9ger les syst\u00e8mes Windows contre une attaque\ndistante. Cependant, le 15 juillet 2021, Microsoft a publi\u00e9 un\nbulletin de s\u00e9curit\u00e9 \\[3\\] qui confirme l\u0027existence d\u0027une vuln\u00e9rabilit\u00e9\n\u003cu\u003enon corrig\u00e9e\u003c/u\u003e permettant une \u00e9l\u00e9vation locale des privil\u00e8ges avec\nles privil\u00e8ges SYSTEM. Cette vuln\u00e9rabilit\u00e9 est r\u00e9f\u00e9renc\u00e9e par\nl\u0027identifiant CVE-2021-34481 \\[4\\]. L\u0027attaquant exploite la\nvuln\u00e9rabilit\u00e9 en acc\u00e9dant au syst\u00e8me cible localement. Il peut \u00e9galement\ns\u0027appuyer sur une interaction avec l\u0027utilisateur pour effectuer les\nactions requises afin d\u0027exploiter la vuln\u00e9rabilit\u00e9 (ex. : inciter un\nutilisateur l\u00e9gitime \u00e0 ouvrir un document malveillant).\n\n\u003cstrong\u003eLe CERT-FR rappelle que les recommandations ci-dessous sont toujours\nvalables. Par ailleurs, des compl\u00e9ments d\u0027aide \u00e0 la d\u00e9tection ont \u00e9t\u00e9\najout\u00e9s ci-apr\u00e8s.\u003c/strong\u003e\n\n\u00a0\n\n\u00a0\n\n\u003cstrong\u003e\\[version du 12 juillet, 15h30\\]\u003c/strong\u003e Correction d\u0027une erreur dans le nom\ndu chemin \"C:\\\\Windows\\\\System32\\\\spool\\\\drivers\", il s\u0027agit bien de\n\"drivers\" et non pas \"driver\".\n\n\u003cstrong\u003e\\[version du 08 juillet 2021 14h30\\]\u003c/strong\u003e Le correctif publi\u00e9 par\nMicrosoft ainsi que la s\u00e9curisation de la fonctionnalit\u00e9 \"Point and\nPrint\" (d\u00e9crite ci-dessous) permettent de se pr\u00e9munir contre une\nex\u00e9cution de code arbitraire \u00e0 distance. L\u0027application de ces mesures\npermet d\u0027envisager la r\u00e9activation de l\u0027impression distante sur les\nserveurs d\u0027impression (cf. ci-dessous).\n\n\u003cstrong\u003e\\[version du 08 juillet 2021 09h00 : information concernant la\npublication des correctifs, ajout d\u0027une recommandation de l\u0027\u00e9diteur\\]\u003c/strong\u003e\nvoir ci-dessous.\u003cstrong\u003e  \n\u003c/strong\u003e\n\n\u003cstrong\u003e\\[version du 07 juillet 2021 10h00 : information concernant la\npublication des correctifs\\]\u003c/strong\u003e se r\u00e9f\u00e9rer \u00e0 la section \"Solution\".\n\n\u00a0\n\n\u003cstrong\u003e\\[version initiale\\]\u003c/strong\u003e\n\n\u003cstrong\u003eCette alerte annule et remplace l\u2019alerte CERT-FR\nCERTFR-2021-ALE-013.\u003c/strong\u003e\n\nLe 29 juin 2021, deux chercheurs ont pr\u00e9sent\u00e9 une fa\u00e7on d\u2019exploiter une\nvuln\u00e9rabilit\u00e9 affectant le spouleur d\u2019impression (*print spooler*) et\npermettant une ex\u00e9cution de code \u00e0 distance, entra\u00eenant une \u00e9l\u00e9vation de\nprivil\u00e8ges avec les droits SYSTEM.\n\nLe 1\u003csup\u003eer\u003c/sup\u003e juillet 2021, Microsoft a publi\u00e9 un avis de s\u00e9curit\u00e9 indiquant\nque cette vuln\u00e9rabilit\u00e9 \u00ab\u00a0jour z\u00e9ro\u00a0\u00bb (*zero day*) est diff\u00e9rente de la\nvuln\u00e9rabilit\u00e9 CVE-2021-1675 initialement corrig\u00e9e lors du Patch Tuesday\ndu 09 juin 2021.\n\nCette nouvelle vuln\u00e9rabilit\u00e9, CVE-2021-34527, affecte le spouleur\nd\u2019impression (*print spooler*) qui est un composant du syst\u00e8me\nd\u2019exploitation Windows activ\u00e9 par d\u00e9faut. Elle permet \u00e0 un attaquant\nd\u2019ex\u00e9cuter du code arbitraire \u00e0 distance avec les droits SYSTEM.\n\n\u003cstrong\u003eDes codes d\u0027exploitation sont publiquement disponibles sur Internet\u003c/strong\u003e,\nce qui signifie que l\u2019exploitation de cette vuln\u00e9rabilit\u00e9 est imminente\nou d\u00e9j\u00e0 en cours.\n\nCes codes exploitent la possibilit\u00e9 offerte par le service\u00a0spouleur\nd\u0027impression de t\u00e9l\u00e9verser un pilote, dans le cadre de l\u2019ajout d\u2019une\nnouvelle imprimante, pour installer un code malveillant. \u003cstrong\u003eCe service\n\u00e9tant activ\u00e9 par d\u00e9faut, tout syst\u00e8me Windows est donc actuellement\nvuln\u00e9rable, avec la possibilit\u00e9 d\u0027une exploitation \u00e0 distance.\u003c/strong\u003e\n\nEn particulier, au sein d\u0027un syst\u00e8me d\u0027information Microsoft, les\ncontr\u00f4leurs de domaine Active Directory sont particuli\u00e8rement expos\u00e9s,\npuisqu\u0027un attaquant, ayant pr\u00e9alablement compromis un poste utilisateur,\npourra *in fine* obtenir les droits et privil\u00e8ges de niveau\n\"administrateur de domaine\" Active Directory.\n\n\u003cstrong\u003eL\u2019ANSSI recommande fortement de r\u00e9aliser les actions suivantes\u00a0:\u003c/strong\u003e\n\n-   pour tous les syst\u00e8mes ne n\u00e9cessitant pas le service d\u0027impression,\n    en particulier pour les contr\u00f4leurs de domaine (le CERT-FR\n    recommande fortement de ne \u003cu\u003ejamais activer\u003c/u\u003e le service spouleur\n    d\u0027impression sur les contr\u00f4leurs de domaine) :\n    -   modifier le type de d\u00e9marrage vers la valeur \"D\u00e9sactiv\u00e9\" /\n        \"Disabled\" pour le service \"Spooler\" (description : \"Spouleur\n        d\u0027impression\" / \"Print Spooler\", ex\u00e9cutable : \"spoolsv.exe\"),\n    -   une fois le service d\u00e9sactiv\u00e9, il est n\u00e9cessaire d\u2019arr\u00eater\n        manuellement le service ou de red\u00e9marrer la machine\u00a0;\n-   appliquer une politique de filtrage r\u00e9seau afin d\u0027\u00e9viter les\n    lat\u00e9ralisations sur les syst\u00e8mes n\u00e9cessitant le service d\u0027impression\n    (notamment les postes de travail) : on pourra notamment utiliser le\n    pare-feu int\u00e9gr\u00e9 pour interdire les connexions entrantes sur les\n    ports 445 et 139 (canaux nomm\u00e9s SMB) ainsi qu\u0027interdire les\n    connexions \u00e0 destination du processus spoolsv.exe ;\n-   \u003cstrong\u003e\\[08 juillet 2021 14h30\\]\u003c/strong\u003e \u003cu\u003esur les \u00e9quipements non corrig\u00e9s ou\n    qui ne sont pas des serveurs d\u0027impression\u003c/u\u003e, d\u00e9sactiver la prise\n    en compte des demandes d\u2019impression distante \u003cs\u003esur l\u2019ensemble des\n    syst\u00e8mes\u003c/s\u003e, tout en laissant la possibilit\u00e9 de lancer une\n    impression locale. Ce param\u00e8tre peut \u00eatre d\u00e9fini \u00e0 l\u2019aide d\u2019une\n    Strat\u00e9gie de Groupe (*Group Policy*)\u00a0: le param\u00e8tre \u00ab\u00a0Autoriser le\n    spouleur d\u2019impression \u00e0 accepter les connexions des clients\u00a0\u00bb doit\n    \u00eatre \u00e0 l\u2019\u00e9tat \u00ab\u00a0D\u00e9sactiv\u00e9\u00a0\u00bb/\u00ab\u00a0Disabled\u00a0\u00bb (\u00ab\u00a0Configuration\n    ordinateur\u00a0\u00bb / \u00abMod\u00e8le d\u2019administration\u00a0\u00bb / \u00ab\u00a0Imprimantes\u00a0\u00bb) ;\n-   mettre en place une d\u00e9tection syst\u00e8me et r\u00e9seau dans le but de\n    d\u00e9tecter les exploitations sur les \u00e9quipements vuln\u00e9rables, les\n    \u00e9ventuelles lat\u00e9ralisations ainsi que la compromission des contr\u00f4les\n    de domaine Active Directory ;\n-   suivre les recommandations de s\u00e9curisation d\u0027Active Directory \\[1\\].\n\n### Informations d\u0027aide \u00e0 la d\u00e9tection syst\u00e8me\n\nUne premi\u00e8re mesure de d\u00e9tection des codes d\u0027exploitation actuels\nconsistera en la surveillance des processus enfant cr\u00e9\u00e9s par le\nprocessus *spoolsv.exe*, les codes d\u0027exploitation utilisant cette\ntechnique pour ex\u00e9cuter un code malveillant. Pour tracer la cr\u00e9ation\nd\u0027un processus fils, on peut regarder les \u00e9v\u00e8nements suivants :\n\n-   l\u0027\u00e9v\u00e8nement num\u00e9ro 4688 du fournisseur\n    \"Microsoft-Windows-Security-Auditing\" enregistr\u00e9 dans le journal de\n    s\u00e9curit\u00e9, si la strat\u00e9gie est configur\u00e9e pour le g\u00e9n\u00e9rer car cet\n    \u00e9v\u00e8nement n\u0027est pas produit par d\u00e9faut ;\n-   l\u0027\u00e9v\u00e8nement num\u00e9ro 1 du fournisseur \"Microsoft-Windows-Sysmon\"\n    enregistr\u00e9 dans le journal sysmon si l\u0027outil System Monitor est\n    install\u00e9.\n\nIl convient de noter que les moyens de d\u00e9tection ci-dessus sont\npertinents dans le cadre de la d\u00e9tection d\u0027une exploitation \u00e0 l\u0027aide des\ncodes publi\u00e9s le 29 juin 2021.\n\nEn compl\u00e9ment, il pourrait \u00eatre utile de tracer\u00a0:\n\n-   l\u2019\u00e9v\u00e8nement num\u00e9ro 11 du fournisseur\n    \"Microsoft-Windows-Security-Mitigations/KernelMode\", qui pourra \u00eatre\n    utilis\u00e9 afin d\u2019identifier le chargement d\u2019une biblioth\u00e8que dynamique\n    (*dll*) non sign\u00e9e (champs SignatureLevel et ImageName) par le\n    processus spoolsv.exe\n    (\u00ab\u00a0ProcessPath:\\*\\\\Windows\\\\System32\\\\spoolsv.exe\u00a0\u00bb).\n-   l\u2019\u00e9v\u00e8nement num\u00e9ro 7 du fournisseur\n    \"Microsoft-Windows-Sysmon/Operational\" avec une configuration\n    appropri\u00e9e de System Monitor pour identifier le chargement de\n    biblioth\u00e8que (*dll*) par le processus spoolsv.exe\n    (\"Image:\\\\C:\\\\Windows\\\\System32\\\\spoolsv.exe\") depuis le r\u00e9pertoire\n    de pilote (champ\n    \"ImageLoaded:C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\\\*\") avec le\n    champ \"Signed\" \u00e0 false\n-   \u003cstrong\u003e\\[16 juillet 2021\\]\u003c/strong\u003e L\u2019\u00e9v\u00e8nement num\u00e9ro 808 du fournisseur\n    \"Microsoft-Windows-PrintService/Admin\" indique qu\u0027une erreur est\n    survenue lors du chargement d\u0027un pilote (le chemin de la dll est\n    mentionn\u00e9 par le champ PluginDllName). Un nom peu commun peut \u00eatre\n    consid\u00e9r\u00e9 comme un marqueur. Note: l\u0027enregistrement de cet \u00e9v\u00e8nement\n    est activ\u00e9 par d\u00e9faut.\n-   \u003cstrong\u003e\\[16 juillet 2021\\]\u003c/strong\u003e Certaines valeurs non usuelles remont\u00e9es par\n    l\u2019\u00e9v\u00e8nement num\u00e9ro 13 du fournisseur\n    \"Microsoft-Windows-Sysmon/Operational\" peuvent indiquer une\n    exploitation. Par exemple : DriverVersion=0.0.0.0,\n    DriverDate=01/01/1601 ou encore Manufacturer=(Empty). L\u0027installation\n    d\u0027un pilote d\u0027imprimante avec une valeur \"Manufacturer\" vide est une\n    action devant \u00eatre consid\u00e9r\u00e9e comme suspecte. De plus, si les cl\u00e9s\n    \"*Configuration File*\" et \"*Data File*\" contiennent la m\u00eame valeur,\n    cela peut-\u00eatre consid\u00e9r\u00e9 comme une exploitation r\u00e9ussie. Note : la\n    configuration doit \u00eatre modifi\u00e9e pour surveiller les modifications\n    de registre dans\n    *HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Environments\\\\Windows\n    x64\\\\Drivers\\\\Version-\\** par spoolsv.exe. Une r\u00e8gle Sigma peut \u00eatre\n    consult\u00e9e en suivant le lien \\[5\\].\n-   \u003cstrong\u003e\\[16 juillet 2021\\]\u003c/strong\u003e Les codes d\u0027exploitation publiques montrent\n    un caract\u00e8re d\u00e9terministe permettant une mise en d\u00e9tection \u00e0 l\u0027aide\n    de l\u2019\u00e9v\u00e8nement num\u00e9ro 316 du fournisseur\n    \"Microsoft-Windows-PrintService/Operational\". En effet, le champs\n    *Param1* contient le nom du driver (1234, Mimikatz\u2026) et le champs\n    *Param4* les valeurs de *pDriverPath*, *pConfigFile*, *pDataFile*.\n    On s\u2019int\u00e9ressera particuli\u00e8rement \u00e0 une valeur suspecte de\n    *pDataFile* ou de *Param1*. Quand l\u0027exploitation est r\u00e9ussie,\n    *pConfigFile* et *pDataFile* ont la m\u00eame valeur : la DLL\n    malveillante. Note : cet \u00e9v\u00e8nement n\u0027est pas activ\u00e9 par d\u00e9faut, il\n    s\u0027active de la fa\u00e7on suivante : *wevtutil.exe sl\n    \"Microsoft-Windows-PrintService/Operational\" /e:True*. Une r\u00e8gle\n    Sigma peut \u00eatre consult\u00e9e en suivant le lien \\[6\\].\n\nEnfin, l\u2019\u00e9diteur met \u00e0 disposition un ensemble d\u2019informations pour les\nutilisateurs de la solution Microsoft 365 Defender \\[2\\].\n",
  "title": "[MaJ] Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": "2021-07-15",
      "title": "[3] Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-34481",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481"
    },
    {
      "published_at": "2021-08-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-36958",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958"
    },
    {
      "published_at": "2021-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-34527",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes 32 bits Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-31975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31975"
    },
    {
      "name": "CVE-2021-31972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31972"
    },
    {
      "name": "CVE-2021-31962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31962"
    },
    {
      "name": "CVE-2021-31958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31958"
    },
    {
      "name": "CVE-2021-31974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31974"
    },
    {
      "name": "CVE-2021-31953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31953"
    },
    {
      "name": "CVE-2021-33742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33742"
    },
    {
      "name": "CVE-2021-31954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31954"
    },
    {
      "name": "CVE-2021-31955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31955"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    },
    {
      "name": "CVE-2021-31977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31977"
    },
    {
      "name": "CVE-2021-31968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31968"
    },
    {
      "name": "CVE-2021-31960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31960"
    },
    {
      "name": "CVE-2021-31969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31969"
    },
    {
      "name": "CVE-2021-31199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31199"
    },
    {
      "name": "CVE-2021-31951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31951"
    },
    {
      "name": "CVE-2021-31976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31976"
    },
    {
      "name": "CVE-2021-31952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31952"
    },
    {
      "name": "CVE-2021-31973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31973"
    },
    {
      "name": "CVE-2021-31956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31956"
    },
    {
      "name": "CVE-2021-26414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26414"
    },
    {
      "name": "CVE-2021-33739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33739"
    },
    {
      "name": "CVE-2021-31971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31971"
    },
    {
      "name": "CVE-2021-31959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31959"
    },
    {
      "name": "CVE-2021-31970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31970"
    },
    {
      "name": "CVE-2021-31201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31201"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-448",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Windows\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9, une\n\u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service, une ex\u00e9cution de code \u00e0\ndistance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 08 juin 2021",
      "url": "https://msrc.microsoft.com/update-guide/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Modicon et PLC Simulator (suivre la proc\u00e9dure de contournement d\u00e9crite dans le bulletin SEVD-2021-222-04)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Pro-face GP-Pro EX versions ant\u00e9rieures \u00e0 V4.09.300",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Vijeo Designer versions ant\u00e9rieures \u00e0 V6.2 SP11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Process Expert toutes versions (inclus HDCS) et SCADAPack RemoteConnect pour x70 (suivre la proc\u00e9dure de contournement d\u00e9crite dans le bulletin SEVD-2021-222-02)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "AccuSine PCS+ / PFV+ versions ant\u00e9rieures \u00e0 V1.6.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Vijeo Designer Basic versions ant\u00e9rieures \u00e0 V1.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Control Expert versions ant\u00e9rieures \u00e0 V15.0 SP1 (suivre la proc\u00e9dure de rem\u00e9diation d\u00e9crite dans le bulletin SEVD-2021-222-02)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "AccuSine PCSn versions ant\u00e9rieures \u00e0 V2.2.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine Expert versions ant\u00e9rieures \u00e0 V2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SHAIIS-MT-111, SHASU-MT-107, SHFK-MT et SHFK-MT-104 sans le dernier correctif pour Windows",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Programmable Automation Controller (PacDrive) M versions ant\u00e9rieures \u00e0 3 (suivre la proc\u00e9dure de contournement d\u00e9crite dans le bulletin SEVD-2021-222-06)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-21814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21814"
    },
    {
      "name": "CVE-2021-34527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34527"
    },
    {
      "name": "CVE-2021-22791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22791"
    },
    {
      "name": "CVE-2021-21830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21830"
    },
    {
      "name": "CVE-2021-21828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21828"
    },
    {
      "name": "CVE-2021-21810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21810"
    },
    {
      "name": "CVE-2021-21813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21813"
    },
    {
      "name": "CVE-2021-22790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22790"
    },
    {
      "name": "CVE-2021-21825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21825"
    },
    {
      "name": "CVE-2021-21829",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21829"
    },
    {
      "name": "CVE-2021-31166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31166"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    },
    {
      "name": "CVE-2021-21826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21826"
    },
    {
      "name": "CVE-2021-21812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21812"
    },
    {
      "name": "CVE-2021-30186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-30186"
    },
    {
      "name": "CVE-2021-21827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21827"
    },
    {
      "name": "CVE-2021-30188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-30188"
    },
    {
      "name": "CVE-2021-22789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22789"
    },
    {
      "name": "CVE-2021-21815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21815"
    },
    {
      "name": "CVE-2021-22792",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22792"
    },
    {
      "name": "CVE-2021-22793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22793"
    },
    {
      "name": "CVE-2021-22704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22704"
    },
    {
      "name": "CVE-2021-30195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-30195"
    },
    {
      "name": "CVE-2021-21811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21811"
    },
    {
      "name": "CVE-2021-22775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22775"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-622",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-08-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une\nex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-08 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-08"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-07 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-07"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-03 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-03"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-01 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-05 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-05"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-04 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-02 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-06 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-06"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Momentum MDI (171CBU*), MC80 (BMKC8*), HART (BMEAH*) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "versadac, toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "EPack toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EPC2000 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M262 Logic Controllers firmware version 5.1.5.35 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SCD6000 Industrial RTU Version ant\u00e9rieures \u00e0 SCD6000 is SY-1101211_Mand",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SCADAPack 312E, 313E, 314E, 330E, 333E, 334E, 337E, 350E et 357E RTUs avec le firmware V8.18.1 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "NMC embedded devices",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMENOC0321, BMENOC0301, BMENOC0311, BMENOS0300 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMECRA31210, BMXCRA31200, BMXCRA31210, 140CRA31200, 140CRA31908 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M241/M251 Logic Controllers firmware version 5.1.9.21 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Process Expert versions ant\u00e9rieures \u00e0 V2021",
      "product": {
        "name": "process",
        "vendor": {
          "name": "Symfony",
          "scada": false
        }
      }
    },
    {
      "description": "Tricon Communication Modules versions ant\u00e9rieures \u00e0 11.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "TelevisAir V3.0 Dongle BTLE (part number ADBT42* et ant\u00e9rieures)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M580 CPU (BMEP* and BMEH*), Modicon M340 CPU (BMXP34*), BMXNOM0200 toutes versions",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easy Harmony GXU (HMIGXU Series) et Easy Harmony ET6 (HMIET Series) Vijeo Designer Basic V1.2 family et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "T2750 PAC, toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "HMISTO Series HMISTU/S5T Series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "TCSEGPA23F14F, BMECXM0100 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "HMISCU,HMIGTU, HMIG2U, HMIG3U, HMIG3X, HMIGTO Series Vijeo Designer (V6.2 SP11) family et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMXNOE0100, BMXNOE0110, BMXNGD0100, BMXNOC0401 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Pro-face GP4100 Series, GP4000E Series, GP4000M Series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Pro-face SP-5B00, SP-5B10, SP-5B90, ST6000 Series (GP-ProEX model), ET6000 Series GP-Pro EX V4.09.300 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Momentum ENT (170ENT11*) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "nanodac toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 2 (NMC2)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Schneider Electric Software Update, V2.3.0 \u00e0 V2.5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 3 (NMC3)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "6100A, 6180A, 6100XIO, 6180XIO, AeroDAQ toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMXNOM0200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "BMENOP0300, BMXNOR0200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon LMC078 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "E+PLC400 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Pro-face GP4000 Series, LT4000M Series, GP4000H Series GP-Pro EX V4.09.300 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22808"
    },
    {
      "name": "CVE-2021-34527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34527"
    },
    {
      "name": "CVE-2021-22811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22811"
    },
    {
      "name": "CVE-2021-22813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22813"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-22807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22807"
    },
    {
      "name": "CVE-2021-22810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22810"
    },
    {
      "name": "CVE-2021-22815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22815"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    },
    {
      "name": "CVE-2021-22812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22812"
    },
    {
      "name": "CVE-2021-22809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22809"
    },
    {
      "name": "CVE-2021-22814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22814"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2021-22799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22799"
    },
    {
      "name": "CVE-2021-22816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22816"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-853",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-11-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-07 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-01 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-06 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-06"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-04 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-02 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-03 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eEcoStruxure Control Expert versions ant\u00e9rieures \u00e0 15.1\u003c/li\u003e \u003cli\u003eEcoStruxure Process Expert versions ant\u00e9rieures \u00e0 2021\u003c/li\u003e \u003cli\u003eSCADAPack RemoteConnect for x70 toutes versions, se r\u00e9f\u00e9rer aux mesures de contournement propos\u00e9es par l\u0027\u00e9diteur\u003c/li\u003e \u003cli\u003eSmart-UPS s\u00e9ries SMT micrologiciels versions ant\u00e9rieures \u00e0 UPS 04.6 permettant une correction partielle de la vuln\u00e9rabilit\u00e9 CVE-2022-0715 et une correction des vuln\u00e9rabilit\u00e9s CVE-2022-22805 et CVE-2022-22806\u003c/li\u003e \u003cli\u003eSmart-UPS s\u00e9ries SMC micrologiciels versions ant\u00e9rieures \u00e0 UPS 04.3 permettant une correction partielle de la vuln\u00e9rabilit\u00e9 CVE-2022-0715 et une correction des vuln\u00e9rabilit\u00e9s CVE-2022-22805 et CVE-2022-22806\u003c/li\u003e \u003cli\u003eAucun correctif n\u0027est disponible pour les s\u00e9ries Smart-UPS SCL, SMX et SRT ainsi que les s\u00e9ries SmartConnect SMTL, SCL, et SMX. Se r\u00e9f\u00e9rer aux mesures de contournement propos\u00e9es par l\u0027\u00e9diteur\u003c/li\u003e \u003cli\u003eRitto Wiser Door toutes versions, se r\u00e9f\u00e9rer aux mesures de contournement propos\u00e9es par l\u0027\u00e9diteur\u003c/li\u003e \u003c/ul\u003e \u003cp\u003ePour les vuln\u00e9rabilit\u00e9s identifi\u00e9es CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782 et CVE-2020-12525, la mise \u00e0 niveau vers EcoStruxure Control Expert v15.1 et EcoStruxure Process Expert v2021 constitue une premi\u00e8re \u00e9tape de contournement. L\u0027\u00e9diteur annoncera la publication d\u0027un nouveau micrologiciel afin de corriger ces vuln\u00e9rabilit\u00e9s.\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-24322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24322"
    },
    {
      "name": "CVE-2021-21814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21814"
    },
    {
      "name": "CVE-2021-34527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34527"
    },
    {
      "name": "CVE-2021-21830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21830"
    },
    {
      "name": "CVE-2021-22797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22797"
    },
    {
      "name": "CVE-2021-22779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22779"
    },
    {
      "name": "CVE-2021-22781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22781"
    },
    {
      "name": "CVE-2021-22780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22780"
    },
    {
      "name": "CVE-2021-21828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21828"
    },
    {
      "name": "CVE-2021-21810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21810"
    },
    {
      "name": "CVE-2021-21813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21813"
    },
    {
      "name": "CVE-2022-22806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22806"
    },
    {
      "name": "CVE-2021-21825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21825"
    },
    {
      "name": "CVE-2021-21829",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21829"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    },
    {
      "name": "CVE-2021-22782",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22782"
    },
    {
      "name": "CVE-2021-22778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22778"
    },
    {
      "name": "CVE-2022-0715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0715"
    },
    {
      "name": "CVE-2021-21826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21826"
    },
    {
      "name": "CVE-2021-21812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21812"
    },
    {
      "name": "CVE-2021-21827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21827"
    },
    {
      "name": "CVE-2022-22805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22805"
    },
    {
      "name": "CVE-2022-24323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24323"
    },
    {
      "name": "CVE-2021-21815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21815"
    },
    {
      "name": "CVE-2021-22783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22783"
    },
    {
      "name": "CVE-2021-21811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21811"
    },
    {
      "name": "CVE-2020-12525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-12525"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-215",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-03-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-02 du 8 mars 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-04 du 09 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-257-01 du 14 septembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-222-02 du 10 ao\u00fbt 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-01 du 8 mars 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-03 du 8 mars 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-03"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider 2021-194-01 du 13 juillet 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes 32 bits Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-31975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31975"
    },
    {
      "name": "CVE-2021-31972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31972"
    },
    {
      "name": "CVE-2021-31962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31962"
    },
    {
      "name": "CVE-2021-31958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31958"
    },
    {
      "name": "CVE-2021-31974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31974"
    },
    {
      "name": "CVE-2021-31953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31953"
    },
    {
      "name": "CVE-2021-33742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33742"
    },
    {
      "name": "CVE-2021-31954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31954"
    },
    {
      "name": "CVE-2021-31955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31955"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    },
    {
      "name": "CVE-2021-31977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31977"
    },
    {
      "name": "CVE-2021-31968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31968"
    },
    {
      "name": "CVE-2021-31960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31960"
    },
    {
      "name": "CVE-2021-31969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31969"
    },
    {
      "name": "CVE-2021-31199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31199"
    },
    {
      "name": "CVE-2021-31951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31951"
    },
    {
      "name": "CVE-2021-31976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31976"
    },
    {
      "name": "CVE-2021-31952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31952"
    },
    {
      "name": "CVE-2021-31973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31973"
    },
    {
      "name": "CVE-2021-31956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31956"
    },
    {
      "name": "CVE-2021-26414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26414"
    },
    {
      "name": "CVE-2021-33739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33739"
    },
    {
      "name": "CVE-2021-31971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31971"
    },
    {
      "name": "CVE-2021-31959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31959"
    },
    {
      "name": "CVE-2021-31970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31970"
    },
    {
      "name": "CVE-2021-31201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31201"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-448",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Windows\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9, une\n\u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service, une ex\u00e9cution de code \u00e0\ndistance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 08 juin 2021",
      "url": "https://msrc.microsoft.com/update-guide/"
    }
  ]
}

{
  "CVSS 2.0": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (Windows 7 Service Pack 1), - (Windows Server 2008 Service Pack 2), - (Windows Server 2012 R2), - (Windows Server 2008 R2 Service Pack 1), - (Windows RT 8.1), - (Windows 10), - (Windows 10 1607), - (Windows Server 2016), - (Windows Server 2008 Service Pack 2 (Server Core Installation)), - (Windows Server 2012 R2 (Server Core installation)), - (Windows Server 2016 (Server Core installation)), - (Windows Server 2008 R2 Service Pack 1 (Server Core installation)), - (Windows 10 1809), - (Windows Server 2019), - (Windows Server 2019 (Server Core installation)), - (Windows 10 1909), - (Windows 10 2004), - (Windows 10 20H2), - (Windows Server 20H2 (Server Core Installation)), - (Windows 10 21H1), - (Windows Server 2012 (Server Core installation))",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "21.06.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.09.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "02.07.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-03322",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-1675",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Windows 7 Service Pack 1, Windows Server 2008 Service Pack 2, Windows Server 2012 R2, Windows Server 2008 R2 Service Pack 1, Windows RT 8.1, Windows 10, Windows 10 1607, Windows Server 2016, Windows Server 2008 Service Pack 2 (Server Core Installation), Windows Server 2012 R2 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows 10 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 1909, Windows 10 2004, Windows 10 20H2, Windows Server 20H2 (Server Core Installation), Windows 10 21H1, Windows Server 2012 (Server Core installation)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Microsoft Corp Windows 7 Service Pack 1 - 64-bit, Microsoft Corp Windows Server 2008 Service Pack 2 - 32-bit, Microsoft Corp Windows 7 Service Pack 1 - 32-bit, Microsoft Corp Windows Server 2008 Service Pack 2 - 64-bit, Microsoft Corp Windows Server 2012 R2 - 64-bit, Microsoft Corp Windows Server 2008 R2 Service Pack 1 - 64-bit, Microsoft Corp Windows RT 8.1 - 32-bit, Microsoft Corp Windows RT 8.1 - 64-bit, Microsoft Corp Windows 10 - 64-bit, Microsoft Corp Windows 10 - 32-bit, Microsoft Corp Windows 10 1607 - 64-bit, Microsoft Corp Windows 10 1607 - 32-bit, Microsoft Corp Windows Server 2008 R2 Service Pack 1 - , Microsoft Corp Windows Server 2016 - , Microsoft Corp Windows RT 8.1 - , Microsoft Corp Windows Server 2008 Service Pack 2 (Server Core Installation) - 32-bit, Microsoft Corp Windows Server 2012 R2 (Server Core installation) - , Microsoft Corp Windows Server 2016 (Server Core installation) - , Microsoft Corp Windows Server 2008 R2 Service Pack 1 (Server Core installation) - 64-bit, Microsoft Corp Windows 10 1809 - 64-bit, Microsoft Corp Windows 10 1809 - 32-bit, Microsoft Corp Windows Server 2019 - , Microsoft Corp Windows Server 2019 (Server Core installation) - , Microsoft Corp Windows 10 1809 - ARM64, Microsoft Corp Windows 10 1909 - 32-bit, Microsoft Corp Windows 10 1909 - 64-bit, Microsoft Corp Windows 10 1909 - ARM64, Microsoft Corp Windows 10 2004 - 32-bit, Microsoft Corp Windows 10 2004 - 64-bit, Microsoft Corp Windows 10 2004 - ARM64, Microsoft Corp Windows 10 20H2 - ARM64, Microsoft Corp Windows 10 20H2 - 32-bit, Microsoft Corp Windows 10 20H2 - 64-bit, Microsoft Corp Windows Server 20H2 (Server Core Installation) - , Microsoft Corp Windows 10 21H1 - 32-bit, Microsoft Corp Windows 10 21H1 - 64-bit, Microsoft Corp Windows 10 21H1 - ARM64, Microsoft Corp Windows Server 2012 (Server Core installation) - ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Windows, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 (CWE-269)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Windows \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://nvd.nist.gov/vuln/detail/CVE-2021-1675\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\nhttp://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html\nhttps://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-269",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,3)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,8)"
}