Microsoft fixes exploited zero-day in Windows Support Diagnostic Tool (CVE-2022-34713)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) | |
| CVE-2022-21980 | Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability NVD description · AI analysis pending | 8.0 group max | 2% |
| — | ||
| CVE-2022-34713 | Remote Code Execution in Microsoft Windows Support Diagnostic Tool (MSDT) (DogWalk) CVE-2022-34713, commonly referred to as 'DogWalk,' is a remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT), patched in Microsoft's August 2022 Patch Tuesday release. The flaw requires user interaction: a user who engages with attacker-supplied content that invokes MSDT can allow the attacker's file operations to run in the context of the logged-on user, yielding high-impact code execution (confidentiality, integrity, and availability all rated high in the CVSS vector). Affected products span essentially the entire supported Windows installed base at the time: Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H2), Windows 11 21H2, and Windows Server 2008 and 2012. The vulnerability was confirmed by Microsoft as an actively exploited zero-day in August 2022 and was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-09, with a required action to apply vendor updates. EPSS assigns it a 67.8% probability of exploitation within 30 days (99th percentile), consistent with in-the-wild use. Do: Apply the August 2022 (or later) Windows security updates on all affected Windows 7, 8.1, RT 8.1, 10 (1507–21H2), 11 21H2, Server 2008, and Server 2012 systems per vendor instructions, prioritizing user-facing workstations where exploitation depends on user interaction. Given the KEV listing, federal and high-value environments should verify patch status immediately and hunt for suspicious MSDT/diagnostic-tool invocations. No public PoC is known, but treat any unpatched system as exposed given confirmed in-the-wild exploitation. | 7.8 | 68% | KEV |
| masshundreds of millions of devices | |
| CVE-2022-35804 | SMB Client and Server Remote Code Execution Vulnerability SMB Client and Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 3% |
| — |
Full article582 words · extracted from helpnetsecurity.com · click to collapse
The August 2022 Patch Tuesday has arrived, with fixes for an unexpectedly high number of vulnerabilities in various Microsoft products, including two zero-days: one actively exploited (CVE-2022-34713) and one not yet (CVE-2022-30134).
Vulnerabilities to prioritize
CVE-2022-34713 is a vulnerability in Microsoft Windows Support Diagnostic Tool (MSDT) that allows for remote code execution. For an attacker to exploit it, they must trick targets into opening a specially crafted file (delivered via email or downloaded from a website).
“Anything actively exploited in the wild must be at the top of the list of things to patch. This one is related to a wave of attacks in May when malicious documents were used to gain code execution via the MSDT tool,” noted Kevin Breen, Director of Cyber Threat Research at Immersive Labs.
According to Microsoft, CVE-2022-34713 is a variant of the vulnerability publicly known as Dogwalk.
“With reports that CVE-2022-34713 has been exploited in the wild, it would appear that attackers are looking to take advantage of flaws within MSDT as these types of flaws are extremely valuable to launch spearphishing attacks. A variety of threat actors leverage spearphishing, from advanced persistent threat (APT) groups to ransomware affiliates,” commented Satnam Narang, senior staff research engineer at Tenable.
“We’ve seen flaws like CVE-2017-11882, a remote code execution bug in Microsoft Office, continue to be exploited years after patches have been made available. For attackers, bugs that can be executed via malicious documents remain a valuable tool, so flaws like Follina and CVE-2022-34713 will continue to be used for months. Therefore, it is vital that organizations apply the available patches as soon as possible.”
CVE-2022-30134 is a publicly known information disclosure vulnerability that affects Microsoft Exchange and could be exploited by attackers to read targeted email messages, but it’s not under attack at the moment.
More importantly, it seems, three other critical elevation of privilege vulnerabilities affecting Exchange – CVE-2022-24477, CVE-2022-24516, CVE-2022-21980 – have been patched by Microsoft.
“Rarely are elevation of privilege (EoP) bugs rated Critical, but these certainly qualify. These bugs could allow an authenticated attacker to take over the mailboxes of all Exchange users. They could then read and send emails or download attachments from any mailbox on the Exchange server. Administrators will also need to enable Extended Protection to fully address these vulnerabilities,” noted Dustin Childs, with Trend Micro’s Zero Day Initiative.
Additional instructions on how to perform those particular updates on on-prem Exchange installations have been provided by Microsoft, and affected users are urged to install them immediately.
“Exchanges can be treasure troves of information, making them valuable targets for attackers,” Breen commented.
“With CVE-2022-24477, for example, an attacker can gain initial access to a user’s host and could take over the mailboxes for all exchange users, sending and reading emails and documents. For attackers focused on business email compromise this kind of vulnerability can be extremely damaging.”
Finally, there’s CVE-2022-35804, an unauthenticated RCE affecting SMB clients and servers.
Childs says it’s potentially wormable and that while there is a workaround (disabling SMBv3 compression), applying the update is to be preferred.
“Microsoft has included a set of remediations that can prevent the attack from being successful, so organisations should consider applying them as soon as possible. Any mitigations that are applied should be tested for compatibility with any interacting services to ensure business continuity is not affected. The patch notes also include advice on limiting access from external connections to the SMB port 445,” Breen added.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/08/09/cve-2022-34713/