Microsoft Partch Tuesday for April 2022 fixed 10 critical vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-26809 | Remote Procedure Call Runtime Remote Code Execution Vulnerability Remote Procedure Call Runtime Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 91% |
| — | ||
| CVE-2022-24521 +1 in the same advisory: …26904 | Out-of-bounds Write Privilege Escalation in Microsoft Windows CLFS Driver CVE-2022-24521 is an elevation-of-privilege flaw in the Windows Common Log File System (CLFS) driver, a kernel component, caused by an out-of-bounds write (CWE-787). A local attacker who already has limited privileges on an affected Windows machine can trigger the bug and gain elevated (SYSTEM/administrator) rights without any user interaction. Because the CLFS driver is part of the operating system, every user and service on an unpatched host is exposed to post-compromise escalation, which ransomware operators use to move from an initial foothold to full control. Affected products per the data include Windows 10 releases 1507, 1607, 1809, 1909, 20H2, 21H1, and 21H2, Windows 11 21H2, Windows 7, Windows 8.1, Windows RT 8.1, and Windows Server 2008. The flaw was patched in Microsoft's April 2022 Patch Tuesday, added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-13, and is known to be used in ransomware campaigns, with public reporting tying exploitation to Cuba ransomware activity. Do: Apply the April 2022 Microsoft security updates (Patch Tuesday, released April 12, 2022) to all affected Windows 10/11, Windows 7/8.1/RT 8.1, and Windows Server 2008 systems immediately, per the CISA KEV required action; note that Windows 7/8.1/RT 8.1 and Server 2008 may require Extended Security Updates to receive the fix. Because this is a local privilege escalation, prioritize hosts reachable for initial access, review endpoint telemetry for suspicious limited-user-to-SYSTEM activity, and watch for indicators associated with Cuba ransomware campaigns exploiting this flaw. | 7.8 group max | 7% | KEV ransomware |
| mass≈1 billion+ Windows devices (the CLFS driver ships in all supported Windows 10/11 and legacy client releases) |
Full article393 words · extracted from securityaffairs.com · click to collapse
Microsoft Partch Tuesday security updates for April 2022 fixed 128 vulnerabilities, including an actively exploited zero-day reported by NSA.
Microsoft Partch Tuesday security updates for April 2022 fixed 128 vulnerabilities in multiple products, including Microsoft Windows and Windows Components, Microsoft Defender and Defender for Endpoint, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Office and Office Components, SharePoint Server, Windows Hyper-V, DNS Server, Skype for Business, .NET and Visual Studio, Windows App Store, and Windows Print Spooler Components.
Ten of the 128 vulnerabilities fixed by Microsoft are rated Critical, 115 are rated Important, and three are rated Moderate in severity.
One of these flaws, tracked as CVE-2022-24521 (CVSS score 7.8), is a Windows Common Log File System Driver Elevation of Privilege issue that is actively exploited. The flaw was reported by the NSA that likely observed its exploitation in attacks conducted by APT groups.
Another flaw, tracked as CVE-2022-26904 (CVSS score 7), is a Windows User Profile Service Elevation of Privilege Vulnerability listed as publicly known at the time of release.
One of the most severe issues addressed with the release of Patch Tuesday Security Updates for April 2022 is an RPC Runtime Library Remote Code Execution flaw (CVE-2022-26809 CVSS 9.8).
“The vulnerability could allow a remote attacker to executed code at high privileges on an affected system. Since no user interaction is required, these factors combine to make this wormable, at least between machine where RPC can be reached. However, the static port used here (TCP port 135) is typically blocked at the network perimeter.” reported ZDI. “Still, this bug could be used for lateral movement by an attacker. Definitely test and deploy this one quickly.”
Some of the most severe issues fixed by the IT giant are two Windows Network File System Remote Code Execution Vulnerability tracked as CVE-2022-24491 and CVE-2022-24497 respectively.
The complete list of CVEs released by Microsoft for April 2022 is here.
Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Microsoft Partch Tuesday)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/130149/breaking-news/microsoft-partch-tuesday-april-2022.html