Microsoft Kicks Off 2022 With 96 Safety Patches

Microsoft in the present day launched its first Patch Tuesday rollout of 2022, which introduced fixes for 96 CVEs. 9 of the vulnerabilities are referred to as Essential and 6 are publicly identified, although none are listed as underneath lively assault.

The merchandise affected on this month’s launch embody Microsoft Home windows, the Edge browser (Chromium-based), Alternate Server, Microsoft Workplace, Microsoft Dynamics, .NET Framework, Open-Supply Software program, Home windows Defender, Home windows Hyper-V, and Distant Desktop Protocol.

That is an “unusually giant” rollout for Microsoft’s first Patch Tuesday of the 12 months, famous Dustin Childs of Pattern Micro’s Zero-Day Initiative in a weblog publish on in the present day’s patches. “Over the previous few years, the typical variety of patches launched in January is about half this quantity,” he famous. It is also a notable change from smaller replace releases that occurred towards the top of 2021.

In in the present day’s launch are a number of vulnerabilities value prioritizing and paying shut consideration to. One among these is CVE-2022-21907, an HTTP Protocol Stack distant code execution (RCE) flaw that an attacker might exploit by sending a specifically crafted packet to a goal server utilizing the HTTP Protocol Stack (http.sys) to course of packets. Microsoft says the vulnerability is wormable.

“The CVE targets the HTTP trailer help characteristic, which permits a sender to incorporate further fields in a message to provide metadata, by offering a specifically crafted message that may result in distant code execution,” says Danny Kim, principal architect at Virsec. An assault requires low complexity, no privileges, and no person interplay to work. Customers are suggested to patch rapidly.

Additionally important are the three distant code execution vulnerabilities patched in Microsoft Alternate Server: CVE-2022-21846, which is taken into account Essential, and CVE-2022-21969 and CVE-2022-21855, each of that are categorized as Essential. All three vulnerabilities require low complexity, no privileges, and no person interplay to use. Microsoft classifies all of them as “exploitation extra possible”.

NSA Stories One
One among these flaws (CVE-2022-21846) was disclosed to Microsoft by the Nationwide Safety Company. Whereas it has a excessive CVSS rating of 9.0, Microsoft famous this difficulty has an “adjoining” assault vector, which means it can’t be exploited throughout the Web however as an alternative wants one thing particular tied to the goal, reminiscent of the identical shared bodily community or logical community. This implies it might require extra effort for the attacker, not like the ProxyLogon or ProxyShell bugs.

One vital vulnerability value a more in-depth look is CVE-2022-21840, a Essential RCE flaw in Microsoft Workplace that requires low complexity and no privileges. The Preview Pane will not be an assault vector right here, Microsoft notes, however an exploit does require person interplay. In an e-mail assault situation, an adversary might ship a specifically crafted file to a sufferer and persuade them to open it. In a Net-based situation, the attacker might host an internet site (or use a compromised web site that accepts or hosts user-provided content material) that comprises a specifically crafted file to use the bug.

Organizations operating Workplace 2019 for Mac and Microsoft Workplace LTSC for Mac 2021 will sadly have to attend for an replace, as patches aren’t but out there for these. Microsoft says prospects will probably be notified by way of CVE revision when they’re made out there.

The six publicly identified points patched in the present day embody an open supply curl RCE vulnerability (CVE-2021-22947) and Libarchive RCE vulnerability (CVE-2021-36976), each of which had their CVE beforehand launched by a 3rd celebration and at the moment are being integrated into Microsoft merchandise. 

Additionally publicly identified are a Home windows certificates spoofing vulnerability (CVE-2022-21836), Home windows Safety Middle API RCE vulnerability (CVE-2022-21874), Home windows person profile service elevation of privilege flaw (CVE-2022-21919), and a Home windows occasion tracing discretionary entry management record denial-of-service vulnerability (CVE-2022-21839).