<div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr"><span style="color:rgb(0,0,0);font-family:"Courier New",monospace">-----BEGIN PGP SIGNED MESSAGE-----</span><br></div><div class="msg308573328986383454"><div dir="ltr">
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
Hash: SHA256</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
CAIS-Alerta [21-08-2024] Vulnerabilidade de execução remota de código TCP/IP do Windows</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
Prezados(as),</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
O CAIS alerta a comunidade de segurança cibernética para uma vulnerabilidade divulgada pela Microsoft referente a uma vulnerabilidade crítica de segurança no sistema operacional Windows, que pode permitir a execução remota de código arbitrário (RCE) não autenticada,
dentro da pilha TCP/IP por meio do protocolo IPv6.</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">Esta vulnerabilidade foi classificada com pontuação CVSS 9.8.</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">O Microsoft Windows é um sistema operativo multitarefa com interface gráfica desenvolvido pela Microsoft. O objetivo do Windows é facilitar o acesso do utilizador ao computador, permitindo-lhe trabalhar com vários programas em simultâneo.
</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
1) Produtos e versões afetadas;</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
2) Identificadores CVE (<a href="http://cve.mitre.org" target="_blank">http://cve.mitre.org</a>);</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
3) Descrição das vulnerabilidades;</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
4) Mitigação e correções disponíveis; e</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
5) Mais informações.</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
1) Produtos e versões afetadas:</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">Todos os sistemas operacionais Windows que utilizam o Internet Protocolo 6 - IPv6<br></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">Versões 10 e 11, e o Windows Server 2008 a 2022<br></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">2) Identificadores CVE (<a href="http://cve.mitre.org" target="_blank">http://cve.mitre.org</a>):</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">CVE-2024-38063</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">3) Descrição das vulnerabilidades:</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
Esta vulnerabilidade ocorre a partir de um estouro de buffer (underflow), nos pacotes de IPv6 através das pilhas TCP/IP do Windows. Um agente malicioso não autenticado que explorar essa vulnerabilidade pode realizar uma sucessão de envios de pacotes IPv6, que
podem incluir pacotes especialmente criados, levando à execução remota de código arbitrário.</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
4) Mitigação e correções disponíveis:</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">O CAIS recomenda fortemente que os administradores de ambientes Windows, que não podem desabilitar o protocolo IPv6 que é habilitado por padrão, apliquem imediatamente os pacotes de atualização fornecidos pela Microsoft.</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">4) Mais informações:</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-38063" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2024-38063</a></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063" target="_blank">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063</a></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
<a href="https://www.bleepingcomputer.com/news/microsoft/zero-click-windows-tcp-ip-rce-impacts-all-systems-with-ipv6-enabled-patch-now/" target="_blank">https://www.bleepingcomputer.com/news/microsoft/zero-click-windows-tcp-ip-rce-impacts-all-systems-with-ipv6-enabled-patch-now/</a></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
<a href="https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes/alertas/2024/alerta-14-2024" target="_blank">https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes/alertas/2024/alerta-14-2024</a></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
O CAIS recomenda que os administradores mantenham seus sistemas e aplicativos sempre atualizados, de acordo com as últimas versões e correções oferecidas pelos fabricantes.</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)"><br></div><div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">Os alertas do CAIS também podem ser acompanhados pelas redes sociais da RNP. Siga-nos!!</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
Twitter: @caisRNP</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
Facebook: <a href="http://facebook.com/RedeNacionaldeEnsinoePesquisaRNP" target="_blank">facebook.com/RedeNacionaldeEnsinoePesquisaRNP</a>.</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
<br>
</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
################################################################</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
# CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS) #</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
# Rede Nacional de Ensino e Pesquisa (RNP) #</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
# #</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
# <a href="mailto:cais@cais.rnp.br" target="_blank">cais@cais.rnp.br</a> <a href="https://www.rnp.br/sistema-rnp/cais" target="_blank">https://www.rnp.br/sistema-rnp/cais</a> #</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
# Tel. 019-37873300 Fax. 019-37873301 #</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
# Chave PGP disponível <a href="https://www.rnp.br/cais/cais-pgp.key" target="_blank">https://www.rnp.br/cais/cais-pgp.key</a> #</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
################################################################</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
-----BEGIN PGP SIGNATURE-----</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
iQIzBAEBCAAdFiEEmWJsLogaTfQskA851Per/VOaV4AFAmbF+Y8ACgkQ1Per/VOa</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
V4ARMA/+P9pwGqEzr9pPGXiDsidEq+2CVL0OddI6dKTncxn49SE3YpgmVYId0x/v</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
z0MRnVAi0JveVlENyVxdAScSxLgKrNH/BLrcgTc4bQyWJJd3bOAA3YwDLngPO/LG</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
+gOl2/PlWjrYQIbcc7kejLSZt4HPNxuZGJkqwKSDIwdn8vJ/bT6UvR27KE48R35R</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
qy1qOfxFWP6p3c9l+ifHz0jSJ6pVqnGuR83+n1arA0BYgyINXa/QBfGFlnJyWi8Z</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
3meSu31E+KY1u26zlGCbmnD7wfUICq+l/wnUu1L+udUOst375z3QcHJFRWo9/GYL</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
65uG91TtqbAysuiFd0urHW5b6Tav0IHWlgaXUZZTDaYwkdsEB9C9n7gn6xlfRa58</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
eqGw7yPbxVkTw5Gym2cwMFmblPjz/HEzf3xvm8BMohrfUW6LLIGoaRa1Y+1AO7Jz</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
pzObdcl0zEb6l9lE0Wteden/hUCZM2JjECdUZ8/3d47x8m3S0KObwG7ZufgnaurD</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
VoW7cXbJGTvuhD98S2o7qX82Ds1MA3H9fu1cdon8UBH49dPNJ7H2ZCHXg8bJJzym</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
sVYf+YGEf04lpZHy6R0S1W6Tf1YIXkYmA8BDTaVq6yLLI0a9RnWRZUkZc+4SLUz3</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
2wZunxmo4psAbaiCIddPUKJ1h8SsDNeKr98XwbSLPfN7eY8fggI=</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
=RXuI</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;color:rgb(0,0,0)">
-----END PGP SIGNATURE-----</div>
<div style="text-indent:0px;white-space:pre-wrap;margin:0px;font-family:"Courier New",monospace;font-size:12pt;color:rgb(0,0,0)"><br></div>
</div>
_______________________________________________<br>
RNP-Alerta<br>
<a href="mailto:rnp-alerta@listas.rnp.br" target="_blank">rnp-alerta@listas.rnp.br</a><br>
<a href="https://listas.rnp.br/mailman/listinfo/rnp-alerta" rel="noreferrer" target="_blank">https://listas.rnp.br/mailman/listinfo/rnp-alerta</a><br>
</div><div class="msg308573328986383454"><br></div><div class="msg308573328986383454"><br></div><div class="msg308573328986383454"><div><br class="gmail-Apple-interchange-newline">===</div><div>Computer Security Incident Response Team - CSIRT</div><div>Universidade Estadual de Campinas - Unicamp</div><div>Centro de Computacao - CCUEC</div><div>GnuPG Public Key: <a href="http://www.security.unicamp.br/security.asc" target="_blank">http://www.security.unicamp.br/security.asc</a> [^]</div><div>Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830</div></div></div></div>