The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Microsoft Internet Messaging API Remote Code Execution Vulnerability (CVE-2021-27089)

  - Windows Kernel Information Disclosure Vulnerability (CVE-2021-27093, CVE-2021-28309)

  - Windows Media Video Decoder Remote Code Execution Vulnerability (CVE-2021-27095, CVE-2021-28315)

  - Windows Installer Spoofing Vulnerability (CVE-2021-26413)

  - Windows Installer Elevation of Privilege Vulnerability (CVE-2021-26415, CVE-2021-28440)

  - Microsoft Windows Codecs Library Information Disclosure Vulnerability (CVE-2021-28317)

  - Windows GDI+ Information Disclosure Vulnerability (CVE-2021-28318)

  - Windows DNS Information Disclosure Vulnerability (CVE-2021-28323, CVE-2021-28328)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2021-28327, CVE-2021-28329,     CVE-2021-28330, CVE-2021-28331, CVE-2021-28332, CVE-2021-28333, CVE-2021-28334, CVE-2021-28335,     CVE-2021-28336, CVE-2021-28337, CVE-2021-28338, CVE-2021-28339, CVE-2021-28340, CVE-2021-28341,     CVE-2021-28342, CVE-2021-28343, CVE-2021-28344, CVE-2021-28345, CVE-2021-28346, CVE-2021-28352,     CVE-2021-28353, CVE-2021-28354, CVE-2021-28355, CVE-2021-28356, CVE-2021-28357, CVE-2021-28358,     CVE-2021-28434)

  - Windows GDI+ Remote Code Execution Vulnerability (CVE-2021-28348, CVE-2021-28349, CVE-2021-28350)

  - Windows Installer Information Disclosure Vulnerability (CVE-2021-28437)

  - Windows TCP/IP Driver Denial of Service Vulnerability (CVE-2021-28439)

  - Windows Console Driver Denial of Service Vulnerability (CVE-2021-28443)

  - Windows Network File System Remote Code Execution Vulnerability (CVE-2021-28445)   
  - Windows Portmapping Information Disclosure Vulnerability (CVE-2021-28446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

KB5001389: Windows Server 2008 Security Update (Apr 2021)

high Nessus Plugin ID 148480

Version 1.12

Version 1.11

Version 1.11

Version 1.12 Jan 4, 2024, 3:23 PM CVSSv3 score source (changed from "CVE-2021-28445" to "CVE-2021-28434") Plugin Feed: 202401041523
Version 1.11 Dec 6, 2022, 1:01 AM Reference Plugin Feed: 202212060101
Version 1.11 Jan 4, 2024, 1:31 PM CVSSv3 score source (changed from "CVE-2021-28445" to "CVE-2021-28434") Plugin Feed: 202401041331