Windows Hyper-V Denial of Service Vulnerability

The remote Windows host is missing security update 4598275 or cumulative update 4598285. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1637, CVE-2021-1656,     CVE-2021-1676, CVE-2021-1696, CVE-2021-1699,     CVE-2021-1708)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1648, CVE-2021-1649, CVE-2021-1650,     CVE-2021-1652, CVE-2021-1653, CVE-2021-1654,     CVE-2021-1655, CVE-2021-1659, CVE-2021-1661,     CVE-2021-1688, CVE-2021-1693, CVE-2021-1694,     CVE-2021-1695, CVE-2021-1702, CVE-2021-1704,     CVE-2021-1706, CVE-2021-1709)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application. (CVE-2021-1674,     CVE-2021-1678, CVE-2021-1683, CVE-2021-1684)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-1679,     CVE-2021-1692)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1657,     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664,     CVE-2021-1665, CVE-2021-1666, CVE-2021-1667,     CVE-2021-1668, CVE-2021-1671, CVE-2021-1673,     CVE-2021-1700, CVE-2021-1701, CVE-2021-1710)

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Windows AppX Deployment Extensions Elevation of Privilege Vulnerability This CVE ID is unique from     CVE-2021-1685. (CVE-2021-1642)

  - Windows DNS Query Information Disclosure Vulnerability (CVE-2021-1637)

  - Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability This CVE ID is unique from     CVE-2021-1680. (CVE-2021-1651)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1653,     CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1652)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1653)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1654)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1655)

  - TPM Device Driver Information Disclosure Vulnerability (CVE-2021-1656)

  - Windows Fax Compose Form Remote Code Execution Vulnerability (CVE-2021-1657)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1658)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1655, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1659)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1660)

  - Windows Installer Elevation of Privilege Vulnerability (CVE-2021-1661)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1664)

  - GDI+ Remote Code Execution Vulnerability (CVE-2021-1665)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1666)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1667)

  - Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability (CVE-2021-1668)

  - Windows Remote Desktop Security Feature Bypass Vulnerability (CVE-2021-1669)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1671)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1673)

  - Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability (CVE-2021-1674)

  - Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability (CVE-2021-1676)

  - Windows CryptoAPI Denial of Service Vulnerability (CVE-2021-1679)

  - Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability This CVE ID is unique from     CVE-2021-1651. (CVE-2021-1680)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1686,     CVE-2021-1687, CVE-2021-1690. (CVE-2021-1681)

  - Windows Bluetooth Security Feature Bypass Vulnerability This CVE ID is unique from CVE-2021-1638,     CVE-2021-1684. (CVE-2021-1683)

  - Windows Bluetooth Security Feature Bypass Vulnerability This CVE ID is unique from CVE-2021-1638,     CVE-2021-1683. (CVE-2021-1684)

  - Windows AppX Deployment Extensions Elevation of Privilege Vulnerability This CVE ID is unique from     CVE-2021-1642. (CVE-2021-1685)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1681,     CVE-2021-1687, CVE-2021-1690. (CVE-2021-1686)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1681,     CVE-2021-1686, CVE-2021-1690. (CVE-2021-1687)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1693. (CVE-2021-1688)

  - Windows Multipoint Management Elevation of Privilege Vulnerability (CVE-2021-1689)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1681,     CVE-2021-1686, CVE-2021-1687. (CVE-2021-1690)

  - Hyper-V Denial of Service Vulnerability This CVE ID is unique from CVE-2021-1691. (CVE-2021-1692)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688. (CVE-2021-1693)

  - Windows Update Stack Elevation of Privilege Vulnerability (CVE-2021-1694)

  - Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2021-1695)

  - Windows Graphics Component Information Disclosure Vulnerability (CVE-2021-1696)

  - Windows InstallService Elevation of Privilege Vulnerability (CVE-2021-1697)

  - Windows GDI+ Information Disclosure Vulnerability (CVE-2021-1708)

  - Windows Win32k Elevation of Privilege Vulnerability (CVE-2021-1709)

  - Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVE-2021-1710)

  - Windows Runtime C++ Template Library Elevation of Privilege Vulnerability (CVE-2021-1650)

  - Active Template Library Elevation of Privilege Vulnerability (CVE-2021-1649)

  - Microsoft splwow64 Elevation of Privilege Vulnerability (CVE-2021-1648)

  - Windows Docker Information Disclosure Vulnerability (CVE-2021-1645)

  - NTLM Security Feature Bypass Vulnerability (CVE-2021-1678)

  - Windows (modem.sys) Information Disclosure Vulnerability (CVE-2021-1699)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673,     CVE-2021-1701. (CVE-2021-1700)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673,     CVE-2021-1700. (CVE-2021-1701)

  - Windows Remote Procedure Call Runtime Elevation of Privilege Vulnerability (CVE-2021-1702)

  - Windows Hyper-V Elevation of Privilege Vulnerability (CVE-2021-1704)

  - Microsoft Edge (HTML-based) Memory Corruption Vulnerability (CVE-2021-1705)

  - Windows LUAFV Elevation of Privilege Vulnerability (CVE-2021-1706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Windows DNS Query Information Disclosure Vulnerability (CVE-2021-1637)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1653,     CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1652)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1653)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1654)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1659, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1655)

  - TPM Device Driver Information Disclosure Vulnerability (CVE-2021-1656)

  - Windows Fax Compose Form Remote Code Execution Vulnerability (CVE-2021-1657)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1658)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1655, CVE-2021-1688, CVE-2021-1693. (CVE-2021-1659)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1660)

  - Windows Installer Elevation of Privilege Vulnerability (CVE-2021-1661)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1664)

  - GDI+ Remote Code Execution Vulnerability (CVE-2021-1665)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1666)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1671, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1667)

  - Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability (CVE-2021-1668)

  - Windows Remote Desktop Security Feature Bypass Vulnerability (CVE-2021-1669)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1673, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1671)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1700,     CVE-2021-1701. (CVE-2021-1673)

  - Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability (CVE-2021-1674)

  - Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability (CVE-2021-1676)

  - Windows CryptoAPI Denial of Service Vulnerability (CVE-2021-1679)

  - Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability This CVE ID is unique from     CVE-2021-1651. (CVE-2021-1680)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1686,     CVE-2021-1687, CVE-2021-1690. (CVE-2021-1681)

  - Windows Bluetooth Security Feature Bypass Vulnerability This CVE ID is unique from CVE-2021-1638,     CVE-2021-1684. (CVE-2021-1683)

  - Windows Bluetooth Security Feature Bypass Vulnerability This CVE ID is unique from CVE-2021-1638,     CVE-2021-1683. (CVE-2021-1684)

  - Windows AppX Deployment Extensions Elevation of Privilege Vulnerability This CVE ID is unique from     CVE-2021-1642. (CVE-2021-1685)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1681,     CVE-2021-1687, CVE-2021-1690. (CVE-2021-1686)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1681,     CVE-2021-1686, CVE-2021-1690. (CVE-2021-1687)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1693. (CVE-2021-1688)

  - Windows Multipoint Management Elevation of Privilege Vulnerability (CVE-2021-1689)

  - Windows WalletService Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1681,     CVE-2021-1686, CVE-2021-1687. (CVE-2021-1690)

  - Hyper-V Denial of Service Vulnerability This CVE ID is unique from CVE-2021-1691. (CVE-2021-1692)

  - Windows CSC Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1652,     CVE-2021-1653, CVE-2021-1654, CVE-2021-1655, CVE-2021-1659, CVE-2021-1688. (CVE-2021-1693)

  - Windows Update Stack Elevation of Privilege Vulnerability (CVE-2021-1694)

  - Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2021-1695)

  - Windows Graphics Component Information Disclosure Vulnerability (CVE-2021-1696)

  - Windows InstallService Elevation of Privilege Vulnerability (CVE-2021-1697)

  - Windows GDI+ Information Disclosure Vulnerability (CVE-2021-1708)

  - Windows Win32k Elevation of Privilege Vulnerability (CVE-2021-1709)

  - Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVE-2021-1710)

  - Windows Runtime C++ Template Library Elevation of Privilege Vulnerability (CVE-2021-1650)

  - Active Template Library Elevation of Privilege Vulnerability (CVE-2021-1649)

  - Microsoft splwow64 Elevation of Privilege Vulnerability (CVE-2021-1648)

  - NTLM Security Feature Bypass Vulnerability (CVE-2021-1678)

  - Windows (modem.sys) Information Disclosure Vulnerability (CVE-2021-1699)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673,     CVE-2021-1701. (CVE-2021-1700)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability This CVE ID is unique from     CVE-2021-1658, CVE-2021-1660, CVE-2021-1664, CVE-2021-1666, CVE-2021-1667, CVE-2021-1671, CVE-2021-1673,     CVE-2021-1700. (CVE-2021-1701)

  - Windows Remote Procedure Call Runtime Elevation of Privilege Vulnerability (CVE-2021-1702)

  - Windows Hyper-V Elevation of Privilege Vulnerability (CVE-2021-1704)

  - Microsoft Edge (HTML-based) Memory Corruption Vulnerability (CVE-2021-1705)

  - Windows LUAFV Elevation of Privilege Vulnerability (CVE-2021-1706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
144888	KB4598275: Windows 8.1 and Windows Server 2012 R2 January 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
144882	KB4598243: Windows 10 Version 1607 and Windows Server 2016 January 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
144873	KB4598231: Windows 10 January 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2021-1692

high

Tenable Plugins

critical

critical

critical