July 2022 Patch Tuesday forecast: A summertime lull?
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26414 | Windows DCOM Server Security Feature Bypass Windows DCOM Server Security Feature Bypass NVD description · AI analysis pending | 4.8 | 50% |
| — | ||
| CVE-2022-2294 | Heap Buffer Overflow in Google Chrome WebRTC Exploited in the Wild CVE-2022-2294 is a heap buffer overflow (out-of-bounds write, CWE-787) in the WebRTC component used by Google Chrome. A remote attacker can trigger the flaw by luring a user to a crafted HTML page, and successful exploitation allows heap corruption with potential arbitrary code execution (CVSS 3.1: 8.8, high impact on confidentiality, integrity and availability). It affects Chrome prior to 103.0.5060.114 and, because the vulnerable code path resides in the shared WebRTC/WebKit component, it also affects Apple's iPhone OS, iPadOS, macOS/Mac OS X, tvOS and watchOS, WebKitGTK, WPE WebKit, Fedora and Extra Packages for Enterprise Linux (EPEL), and the WebRTC project library itself. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-25 with known ransomware use, and reporting indicates mercenary spyware operators used it as a Chrome zero-day; EPSS places its 30-day exploitation probability at 70.5%. Google fixed the flaw in Chrome 103.0.5060.114, and Apple and the WebKit/WPE maintainers issued their own security updates for affected products. Do: Upgrade Google Chrome to 103.0.5060.114 or later on all managed and personal endpoints immediately. Apply Apple's released security updates for iPhone OS, iPadOS, macOS, tvOS and watchOS, and updated WebKitGTK, WPE WebKit and Fedora/EPEL packages for WebKit-based deployments. Given the CISA KEV listing, known ransomware use and 70.5% EPSS, prioritize patching and hunt for signs of exploitation (crafted-page lures and any linked spyware or ransomware activity) across browsers and WebKit applications. | 8.8 | 70% | KEV ransomware |
| mass≈3+ billion Chrome users worldwide, plus additional users of Apple WebKit devices, WebKitGTK, WPE WebKit and Fedora/EPEL browser packages |
Full article612 words · extracted from helpnetsecurity.com · click to collapse
June 2022 Patch Tuesday wrapped up a few loose ends we were waiting on. The Follina remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT) was fixed.
Internet Explorer came to a quiet end in most versions of the Windows 10 operating system. And finally, the Phase 2 update for CVE-2021-26414, the DCOM server security feature bypass was released. With those major updates now in place, could we see a summertime lull in the July 2022 Patch Tuesday updates?
Before we get to the forecast, there was a bit of excitement earlier this week when Google released a Chrome zero-day update – their fourth of the year. Chrome 103.0.5060.114 was released for the Stable Desktop Channel addressing CVE-2022-2294 which is a buffer overflow vulnerability. Because this is known to be exploited in the wild, Google provided few details on the vulnerability allowing time for the update to be distributed and installed.
While on the topic of limited disclosure, there was a report that Microsoft quietly released a fix for an NTLM relay vulnerability as part of the June updates. Per the article, an attack could be conducted resulting in a device impersonating a domain controller, which can gain elevated privileges that can be used to take over the Windows domain. There was concern regarding Microsoft’s transparency on not reporting the vulnerability, nor the fix itself. We’ll see if there is more information released in the July 2022 Patch Tuesday.
There seems to be a lot of confusion surrounding the end-of-support and retirement of Internet Explorer last month. Many expected it to be disabled or uninstalled from those systems which are no longer supported. Microsoft is reserving those options for a future cumulative update on those operating systems, but in the meantime opening IE 11 will display an EOL message and direct the user to a Microsoft Edge download. As announced, Microsoft recommends using IE mode in the Edge browser if you really need it for application compatibility.
We saw a rare SQL server update last Patch Tuesday and I don’t anticipate another this month. Just a reminder that Microsoft SQL Server 2012 reaches EOL July 12. Microsoft will be providing extended security updates (ESU) for three years starting next month, but if you are looking to move to a fully supported SQL version you need to jump to SQL Server 2019. This Patch Tuesday will see the final ESU update for SQL Server 2008 R2, but I’m hoping that won’t impact many of you.
July 2022 Patch Tuesday forecast
- We saw a much smaller number of CVEs addressed last month and I expect that trend to continue in July. Expect the standards updates for Windows 10, 11, and the legacy operating systems. Only a handful of Office applications were updated last month so I anticipate a full suite of Office updates.
- No pre-notifications have been made so far, but Adobe Acrobat and Reader were last updated in April so a major one should surface soon.
- We’re overdue for a Monterey security update with the last coming back in May, but Apple does not release on a standard schedule.
- Google released their zero-day updates as I mentioned. Anticipate a quiet week from them for Patch Tuesday.
- Mozilla released security updates for their applications the last week of June. Firefox 102, Firefox ESR 91.11 and Thunderbird 102 were all updated. I would expect a minor update next week, if any, for these applications.
With the exception of maybe some major Adobe updates for Acrobat and Reader next week, it should be a fairly quiet July Patch Tuesday with just some standard releases from Microsoft. Enjoy the lull in the action.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/07/08/july-2022-patch-tuesday-forecast/