Microsoft Patches Windows Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-22029 +1 in the same advisory: …22039 | Windows Network File System Remote Code Execution Vulnerability Windows Network File System Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.1 group max | 5% |
| — | ||
| CVE-2022-30221 +1 in the same advisory: …22038 | Windows Graphics Component Remote Code Execution Vulnerability Windows Graphics Component Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 group max | 2% |
| — | ||
| CVE-2022-22047 | Local Privilege Escalation in Windows CSRSS Affects Nearly All Windows Versions CVE-2022-22047 is an elevation-of-privilege vulnerability in the Windows Client Server Run-time Subsystem (CSRSS), a core user-mode process that handles console and system tasks, caused by an untrusted search path (CWE-426). An attacker who already has a low-privileged foothold on a Windows machine can trigger the flaw locally, with no user interaction, to elevate to SYSTEM/administrator-level privileges. Because CSRSS is present on essentially every Windows installation, the affected population spans Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H2), Windows 11 21H2, and Windows Server 2008 and 2012, meaning virtually every Windows desktop, laptop, and server in active use is potentially affected. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on July 12, 2022 with an August 2 patch deadline for federal agencies, and EPSS assigns it an 18.8% probability of exploitation within 30 days (97th percentile). Do: Apply Microsoft's July 12, 2022 (Patch Tuesday) security updates immediately across all affected releases, including Windows 7, 8.1, RT 8.1, and Server 2008/2012, where fixes arrive through the same July update servicing; CISA's KEV deadline for federal agencies is August 2, 2022. Treat any host where a local attacker has executed code as potentially compromised to SYSTEM level, and hunt for post-exploitation activity. Keep monitoring vendor guidance, as recent reporting suggests some patched Windows attack surfaces may still be exploitable, so continue applying follow-on Windows updates as they ship. | 7.8 | 19% | KEV |
| mass≈1 billion+ Windows devices and servers (the affected list spans Windows 7 through Windows 11 and legacy server releases) |
Full article329 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft patched a zero-day bug in its latest Patch Tuesday update this week that allowed remote execution on Windows machines and which is already being exploited in the wild.
CVE-2022-22047 is an elevation of privilege vulnerability in the Windows Client/Server Runtime Subsystem (CSRSS), which is responsible for Windows features, including console windows and the shutdown process. Details on how to exploit the bug are understandably scarce given that it has not yet been publicly disclosed, but an attack that succeeds can gain SYSTEM privileges in Windows.
Microsoft only ranked this bug as important, which could cause some customers to miss it. Nevertheless, its exploitation in the wild makes it crucial for organizations to patch it as soon as possible.
CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) list and given federal agencies three weeks to patch it. The patches are mandatory under Binding Operational Directive 22-01, issued in November, which forces agencies to fix bugs in the KEV list.
There were four critical bugs in Microsoft’s patch Tuesday rollout. CVE-2022-22029 and CVE-2022-22039 affect the Windows Network File System. These vulnerabilities enable remote code execution. They are exploitable with a maliciously crafted call to an NFS service.
The CVE-2022-22038 bug, also listed as critical, is a remote code execution vulnerability in the Windows RPC runtime. An attacker can exploit it by sending “constant or intermittent data,” according to Microsoft.
The final critical bug in the lineup was CVE-2022-30221, a flaw in the Windows Graphics Component, which also allows for remote code execution. To exploit this flaw, an attacker would need to target machines with RDP 8.0 or 8.1, said Microsoft. They would have to convince a user to connect to a malicious RDP server that could then execute remote code on the victim’s system.
Adobe also released updates for its Acrobat, Acrobat Reader, Robohelp, Animater, and Photoshop programs on Tuesday. The Acrobat and Reader updates fixed over 20 vulnerabilities, including some that allowed arbitrary code execution.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-patches-window-zero-day/