Microsoft Issues Patches for 2 Windows Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-23259 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 3% |
| — | ||
| CVE-2022-26809 | Remote Procedure Call Runtime Remote Code Execution Vulnerability Remote Procedure Call Runtime Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 group max | 91% |
| — | ||
| CVE-2022-24521 +1 in the same advisory: …26904 | Out-of-bounds Write Privilege Escalation in Microsoft Windows CLFS Driver CVE-2022-24521 is an elevation-of-privilege flaw in the Windows Common Log File System (CLFS) driver, a kernel component, caused by an out-of-bounds write (CWE-787). A local attacker who already has limited privileges on an affected Windows machine can trigger the bug and gain elevated (SYSTEM/administrator) rights without any user interaction. Because the CLFS driver is part of the operating system, every user and service on an unpatched host is exposed to post-compromise escalation, which ransomware operators use to move from an initial foothold to full control. Affected products per the data include Windows 10 releases 1507, 1607, 1809, 1909, 20H2, 21H1, and 21H2, Windows 11 21H2, Windows 7, Windows 8.1, Windows RT 8.1, and Windows Server 2008. The flaw was patched in Microsoft's April 2022 Patch Tuesday, added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-13, and is known to be used in ransomware campaigns, with public reporting tying exploitation to Cuba ransomware activity. Do: Apply the April 2022 Microsoft security updates (Patch Tuesday, released April 12, 2022) to all affected Windows 10/11, Windows 7/8.1/RT 8.1, and Windows Server 2008 systems immediately, per the CISA KEV required action; note that Windows 7/8.1/RT 8.1 and Server 2008 may require Extended Security Updates to receive the fix. Because this is a local privilege escalation, prioritize hosts reachable for initial access, review endpoint telemetry for suspicious limited-user-to-SYSTEM activity, and watch for indicators associated with Cuba ransomware campaigns exploiting this flaw. | 7.8 group max | 7% | KEV ransomware |
| mass≈1 billion+ Windows devices (the CLFS driver ships in all supported Windows 10/11 and legacy client releases) |
Full article408 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 13, 2022
Microsoft's Patch Tuesday updates for the month of April have addressed a total of 128 security vulnerabilities spanning across its software product portfolio, including Windows, Defender, Office, Exchange Server, Visual Studio, and Print Spooler, among others.
10 of the 128 bugs fixed are rated Critical, 115 are rated Important, and three are rated Moderate in severity, with one of the flaws listed as publicly known and another under active attack at the time of the release.
The updates are in addition to 26 other flaws resolved by Microsoft in its Chromium-based Edge browser since the start of the month.
The actively exploited flaw (CVE-2022-24521, CVSS score: 7.8) relates to an elevation of privilege vulnerability in the Windows Common Log File System (CLFS). Credited with reporting the flaw are the U.S. National Security Agency (NSA) and CrowdStrike researchers Adam Podlosky and Amir Bazine.
The second publicly-known zero-day flaw (CVE-2022-26904, CVSS score: 7.0) also concerns a case of privilege escalation in the Windows User Profile Service, successful exploitation of which "requires an attacker to win a race condition."
Other critical flaws to note include a number of remote code execution flaws in RPC Runtime Library (CVE-2022-26809, CVSS score: 9.8), Windows Network File System (CVE-2022-24491 and CVE-2022-24497, CVSS scores: 9.8), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500), and Microsoft Dynamics 365 (CVE-2022-23259).
Microsoft also patched as many as 18 flaws in Windows DNS Server, one information disclosure flaw and 17 remote code execution flaws, all of which were reported by security researcher Yuki Chen. Also remediated are 15 privilege escalation flaws in the Windows Print Spooler component.
The patches arrive a week after the tech giant announced plans to make available a feature called AutoPatch in July 2022 that allows enterprises to expedite applying security fixes in a timely fashion while emphasizing on scalability and stability.
Software Patches from Other Vendors
In addition to Microsoft, security updates have also been released by other vendors to rectify several vulnerabilities, counting —
- Adobe
- Android
- Apache Struts 2
- Cisco Systems
- Citrix
- Dell
- Google Chrome
- HP Teradici PCoIP Client
- Juniper Networks
- Linux distributions Oracle Linux, Red Hat, and SUSE
- Mozilla Firefox, Firefox ESR, and Thunderbird
- SAP
- Schneider Electric
- Siemens, and
- VMware
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/04/microsoft-issues-patches-for-2-windows.html