A "light" February 2022 Patch Tuesday that should not be ignored
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2013-3900 | Authenticode Signature Verification Flaw in Microsoft WinVerifyTrust (RCE) Microsoft's WinVerifyTrust function improperly validates Windows Authenticode signatures on portable executable (PE) files, allowing crafted modifications to a signed binary — such as altered sections or checksum-table manipulation — to still pass signature verification. An attacker who tampers with a legitimately signed executable can distribute modified files that Windows and dependent security controls treat as authentic, gaining the trust of a valid digital signature and, ultimately, remote code execution in contexts that rely on signature checks. Any Microsoft Windows platform performing Authenticode verification through WinVerifyTrust is affected; the source data does not list specific Windows version ranges, but because WinVerifyTrust is core Windows functionality the exposure is very broad. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-10, indicating confirmed in-the-wild exploitation, and EPSS puts its 30-day exploitation probability at about 44.6% (99th percentile), though no public PoC is known. Do: Apply Microsoft's updates for CVE-2013-3900 across all Windows systems per vendor instructions, as required for CISA KEV entries. Where supported, enable Microsoft's stricter certificate padding check (EnableCertPaddingCheck) per Microsoft guidance to harden signature verification against this bypass. Prioritize patching endpoints and servers that execute or validate downloaded, emailed, or otherwise externally sourced signed binaries, given confirmed exploitation and high EPSS. | — | 45% | KEV |
| masshundreds of millions of Windows devices (near-universal across the Windows installed base) | |
| CVE-2022-21882 | Out-of-Bounds Write LPE in Microsoft Win32k on Windows 10/11 and Windows Server CVE-2022-21882 is a Win32k elevation-of-privilege vulnerability caused by an out-of-bounds write (CWE-787) in the Windows kernel's Win32k component, affecting Windows 10 versions 1809 through 21H2, Windows 11 21H2, and Windows Server 2019, 2022, and version 20H2. A local attacker who can already execute code with a low-privileged account can trigger the flaw via Win32k system calls with no user interaction, corrupting kernel memory and escalating to SYSTEM-level privileges. Successful exploitation gives the attacker full control of the compromised host (high confidentiality, integrity, and availability impact), and it is commonly chained after an initial foothold to deploy ransomware or other payloads. Anyone running the affected Windows 10, Windows 11, or Windows Server builds is exposed, because the vulnerable Win32k code ships by default with those operating systems. The flaw is actively exploited in the wild: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-04) with known ransomware use, and public proof-of-concept code was released by researchers after disclosure. Do: Apply Microsoft's cumulative security updates for Windows 10 (1809–21H2), Windows 11 21H2, and Windows Server 2019/2022/20H2 immediately — the fix shipped in Microsoft's January 2022 Patch Tuesday and is included in all later cumulative updates; per CISA's required action, apply updates per vendor instructions. Prioritize multi-user hosts (RDS/VDI, terminal and jump servers) where local privilege escalation is most damaging, and hunt for post-compromise indicators such as unexpected SYSTEM-level processes, since ransomware operators are known to use this bug after gaining an initial foothold. If patching is delayed, limit local code execution on affected systems and watch EDR telemetry for kernel-level privilege-escalation behavior. | 7.8 | 59% | KEV ransomware |
| mass≈1 billion Windows 10/11 devices plus millions of Windows Server instances (installed-base estimate) | |
| CVE-2022-21984 | Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 group max | 5% |
| — | ||
| CVE-2022-21999 | Local Privilege Escalation in Microsoft Windows Print Spooler (CISA KEV) CVE-2022-21999 is a privilege elevation vulnerability in the Windows Print Spooler service, caused by improper encapsulation of resources (CWE-40), which lets a local, limited-privilege user manipulate spooler resource handling and execute code with elevated rights. An attacker gains SYSTEM-level privileges on the affected Windows host after already obtaining some foothold locally, making it a common post-compromise escalation step rather than a remote entry point. Any Windows system with the Print Spooler service enabled — the default on most Windows desktop and server installations — is affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-03-25 with known ransomware use, and EPSS assigns a 41.7% chance of exploitation within 30 days (99th percentile), while the source data records no public proof-of-concept. Required action per CISA is to apply Microsoft updates per vendor instructions. Do: Apply the vendor security updates per Microsoft's instructions, as required by CISA's KEV listing; since the source data does not specify fixed versions, verify your current Windows build against Microsoft's advisory. As an interim mitigation, disable the Print Spooler service on hosts where local or shared printing is not required. Because the flaw is exploited in the wild and linked to ransomware, check spooler-related privilege escalation activity in logs and prioritize patching servers and workstations accessible to low-privileged users. | 7.8 | 42% | KEV ransomware |
| masshundreds of millions of Windows devices (Print Spooler enabled by default on most desktop/server installs) | |
| CVE-2022-23280 | Microsoft Outlook for Mac Security Feature Bypass Vulnerability Microsoft Outlook for Mac Security Feature Bypass Vulnerability NVD description · AI analysis pending | 5.3 | 2% |
| — |
Full article685 words · extracted from helpnetsecurity.com · click to collapse
February 2022 Patch Tuesday is here and it’s all-around “light” – light in fixed CVE-numbered vulnerabilities (51), extremely light in critical fixes (50 are “important” and one is “moderate”), and light in exploited vulnerabilities (none of the vulnerabilities are listed as under active attack).
Only one is listed as publicly known – CVE-2022-21989, a Windows Kernel EOP flaw – but while there’s apparently a PoC exploit out there (not necessarily public), “Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.”
Microsoft also noted that exploitation of the vulnerability could be performed from a low privilege AppContainer. “The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment,” they said.
Other vulnerabilities of note
Dustin Childs, with Trend Micro’s Zero Day Initiative, advises admins of Windows DNS servers to consider CVE-2022-21984, a RCE flaw, critical.
“The server is only affected if dynamic updates are enabled, but this is a relatively common configuration. If you have this setup in your environment, an attacker could completely take over your DNS and execute code with elevated privileges,” he warned.
He also noted that enterprise admins that oversee Hyper-V servers should patch for CVE-2022-21995, a Windows Hyper-V RCE vulnerability, despite the fact that the complexity of a successful attack exploiting it is rated as “High”.
Mac users of Microsoft Outlook may also want to patch CVE-2022-23280, a feature bypass vulnerability, quickly. “This Outlook bug could allow images to appear in the Preview Pane automatically, even if this option is disabled. On its own, exploiting this will only expose the target’s IP information. However, it’s possible a second bug affecting image rendering could be paired with this bug to allow remote code execution,” Childs explained.
Danny Kim, Principal Architect at Virsec, noted that it’s interesting that Microsoft republished a CVE-2013-3900, a vulnerability from 2013, to notify customers that an update to Windows 10/11 is available that addresses it.
“The CVE allows an attacker to inject malicious code into a signed application without invalidating the file’s original signature. With the ability to inject malicious code into ‘verified’ applications, the attacker can gain complete control over a system especially if the user who runs the application has administrative privileges. The attacker can go as far as creating new user accounts with full access allowing the attacker to login to the machine at will,” he told Help Net Security.
“This type of CVE, though it is originally from 2013, highlights two concerning facts that are still relevant today: patching is a slow-moving solution and applications need to be monitored at all times. Patching is a post-attack solution that moves too slowly to keep up with today’s attacks. Applications, even verified ones, cannot just be checked when they start execution – their behavior throughout the lifetime of the application needs to be monitored and verified against expected behavior.”
Satnam Narang, staff research engineer at Tenable, singled out four elevation of privilege vulnerabilities in its Windows Print Spooler, including two rated Exploitation More Likely.
“One of these two flaws, CVE-2022-21999, is credited to researchers at Sangfor, who were responsible for disclosing some of the PrintNightmare vulnerabilities last summer. Because of the ubiquity of Print Spooler, vulnerabilities like this have been leveraged by ransomware groups. Organizations should apply these patches as soon as possible,” he advises.
Finally, Kevin Breen, Director of Cyber Threat Research at Immersive Labs, noted that Microsoft has released more patches for the same style of vulnerability (and in the same component) as CVE-2022-21882, a vulnerability in Win32k that is being actively exploited in the wild, which prompted CISA to issue a directive to all federal agencies to mandate that patches be applied.
“It’s not clear from the release notes whether this is a brand-new vulnerability or if it is related to the previous month’s update. Either way, we have seen attackers leverage this vulnerability so it’s safer to err on the side of caution and update this one quickly,” he says.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/02/08/february-2022-patch-tuesday/