Windows Key Storage Provider Security Feature Bypass Vulnerability

The remote Windows host is missing security update 5005566.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-36954, CVE-2021-36955, CVE-2021-36963,     CVE-2021-36964, CVE-2021-36966, CVE-2021-36967,     CVE-2021-36973, CVE-2021-36974, CVE-2021-36975,     CVE-2021-38628, CVE-2021-38630, CVE-2021-38633,     CVE-2021-38634, CVE-2021-38638, CVE-2021-38639,     CVE-2021-38667, CVE-2021-38671, CVE-2021-40447)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-26435)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-36960, CVE-2021-36962,     CVE-2021-36969, CVE-2021-36972, CVE-2021-38629,     CVE-2021-38635, CVE-2021-38636, CVE-2021-38637)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-38624, CVE-2021-38632)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-36965,     CVE-2021-36958, CVE-2021-40444))

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-36961)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36959)

The remote Windows host is missing security update 5005565.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-36954, CVE-2021-36955, CVE-2021-36963,     CVE-2021-36964, CVE-2021-36966, CVE-2021-36967,     CVE-2021-36973, CVE-2021-36974, CVE-2021-36975,     CVE-2021-38628, CVE-2021-38630, CVE-2021-38633,     CVE-2021-38634, CVE-2021-38638, CVE-2021-38639,     CVE-2021-38667, CVE-2021-38671, CVE-2021-40447)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-26435)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-36960, CVE-2021-36962,     CVE-2021-36969, CVE-2021-36972, CVE-2021-38629,     CVE-2021-38635, CVE-2021-38636, CVE-2021-38637)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-38624, CVE-2021-38632)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-36965,     CVE-2021-36958, CVE-2021-40444)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-36961)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36959)

The remote Windows host is missing security update 5005573.
It is, therefore, affected by multiple vulnerabilities :

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-26435)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-36960, CVE-2021-36962,     CVE-2021-36969, CVE-2021-36972, CVE-2021-38629,     CVE-2021-38635, CVE-2021-38636)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-38624, CVE-2021-38632)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-36955, CVE-2021-36963, CVE-2021-36964,     CVE-2021-36967, CVE-2021-36973, CVE-2021-36974,     CVE-2021-38628, CVE-2021-38630, CVE-2021-38633,     CVE-2021-38634, CVE-2021-38638, CVE-2021-38639,     CVE-2021-38667, CVE-2021-38671, CVE-2021-40447)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-36965,     CVE-2021-36958, CVE-2021-40444)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-36961)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36959)

The remote Windows host is missing security update 5005627 or cumulative update 5005613. It is, therefore, affected by multiple vulnerabilities :

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-26435)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-36960, CVE-2021-36962,     CVE-2021-36969, CVE-2021-36972, CVE-2021-38629,     CVE-2021-38635, CVE-2021-38636)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-36965,     CVE-2021-36958, CVE-2021-40444)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-36955, CVE-2021-36963, CVE-2021-36964,     CVE-2021-36974, CVE-2021-38628, CVE-2021-38630,     CVE-2021-38633, CVE-2021-38638, CVE-2021-38639,     CVE-2021-38667, CVE-2021-38671, CVE-2021-40447)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-36961)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-38624)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36959)

The remote Windows host is missing security update 5005568.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-36954, CVE-2021-36955, CVE-2021-36963,     CVE-2021-36964, CVE-2021-36966, CVE-2021-36967,     CVE-2021-36973, CVE-2021-36974, CVE-2021-36975,     CVE-2021-38628, CVE-2021-38630, CVE-2021-38633,     CVE-2021-38634, CVE-2021-38638, CVE-2021-38639,     CVE-2021-38667, CVE-2021-38671, CVE-2021-40447)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-26435)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-36960, CVE-2021-36962,     CVE-2021-36969, CVE-2021-36972, CVE-2021-38629,     CVE-2021-38635, CVE-2021-38636, CVE-2021-38637)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-38624, CVE-2021-38632)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-36965,     CVE-2021-36958, CVE-2021-40444)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-36961)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36959)

The remote Windows host is missing security update 5005569.
It is, therefore, affected by multiple vulnerabilities :

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-26435)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-36960, CVE-2021-36962,     CVE-2021-36969, CVE-2021-36972, CVE-2021-38629,     CVE-2021-38635, CVE-2021-38636)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-36955, CVE-2021-36963, CVE-2021-36964,     CVE-2021-36967, CVE-2021-36973, CVE-2021-36974,     CVE-2021-38628, CVE-2021-38630, CVE-2021-38633,     CVE-2021-38634, CVE-2021-38638, CVE-2021-38639,     CVE-2021-38667, CVE-2021-38671, CVE-2021-40447)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-36965,     CVE-2021-36958, CVE-2021-40444)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-36961)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-38624)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36959)

ID	Name	Product	Family	Severity
153383	KB5005566: Windows 10 version 1909 / Windows Server 1909 Security Update (September 2021)	Nessus	Windows : Microsoft Bulletins	high
153381	KB5005565: Windows 10 Version 2004 / Windows 10 Version 20H2 / Windows 10 Version 21H1 Security Update (September 2021)	Nessus	Windows : Microsoft Bulletins	high
153377	KB5005573: Windows 10 Version 1607 and Windows Server 2016 September 2021 Security Update	Nessus	Windows : Microsoft Bulletins	high
153375	KB5005627: Windows 8.1 and Windows Server 2012 R2 September 2021 Security Update	Nessus	Windows : Microsoft Bulletins	high
153373	KB5005568: Windows 10 Version 1809 and Windows Server 2019 September 2021 Security Update	Nessus	Windows : Microsoft Bulletins	high
153372	KB5005569: Windows 10 version 1507 LTS September 2021 Security Update	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2021-38624

medium

Tenable Plugins

high

high

high

high

high

high