Microsoft fixes Follina and 55 other CVEs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-29972 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbitrary code. NVD description · AI analysis pending | 7.8 | 4% |
| — | ||
| CVE-2022-30136 | Windows Network File System Remote Code Execution Vulnerability Windows Network File System Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 73% |
| — | ||
| CVE-2022-30163 | Windows Hyper-V Remote Code Execution Vulnerability Windows Hyper-V Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.5 group max | 2% |
| — | ||
| CVE-2022-30190 | MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28. Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly. | 7.8 | 99% | KEV ransomware PoC |
| mass≈1 billion+ Windows devices (effectively the entire supported Windows installed base) |
Full article605 words · extracted from helpnetsecurity.com · click to collapse
June 2022 Patch Tuesday has been marked by Microsoft with the release of fixes for 55 new CVEs, as well as security updates that fix Follina (CVE-2022-30190), the Microsoft Windows Support Diagnostic Tool (MSDT) RCE that is being widely exploited by attackers.
“The update for [CVE-2022-30190] is in the June 2022 cumulative Windows Updates. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action,” the company noted.
Other vulnerabilities to prioritize
Microsoft has patched flaws in Windows and Windows Components, Office and Office Components, Microsoft Edge; Windows Hyper-V Server, .NET and Visual Studio, SharePoint Server, Windows Defender, Windows Powershell, Windows LDAP, and other solutions.
Of the three critical vulnerabilities fixed, Dustin Childs, with Trend Micro’s Zero Day Initiative, singled out CVE-2022-30136, a Windows Network File System (NFS) RCE that could be triggered over the network with an unauthenticated, specially crafted call to a Network File System (NFS) service. It affects only several versions of Windows Server.
CVE-2022-30163, a Windows Hyper-V vulnerability that allows a guest-to-host escape should also be addressed quickly.
“Microsoft notes that attack complexity is high since an attacker would need to win a race condition. However, we have seen many reliable exploits demonstrated that involve race conditions, so take the appropriate step to test and deploy this update,” Childs explained.
CVE-2022-30139, a Windows LDAP RCE flaw is deemed critical, but for it to be exploitable an attacker would either have to target a system with a non-default value of the MaxReceiveBuffer LDAP policy, or to prepare the target environment accordingly before running the exploit. This patch can, therefore, wait a bit.
CVE-2022-30148, on the other hand, should be prioritized by system administrators who use Windows Desired State Configuration (DSC), Childs opined.
“Most info disclosure bugs simply leak unspecified memory contents, but this bug is different. An attacker could use this to recover plaintext passwords and usernames from log files,” he noted.
“Since DSC is often used by SysAdmins to maintain machine configurations in an enterprise, there are likely some sought-after username/password combos that could be recovered. This would also be a great bug for an attacker to move laterally within a network.”
A quick reminder for Azure Synapse and Data Factory customers
As a side note unrelated to the Patch Tuesday fixes but still relevant for certain Microsoft customers, Orca Security researcher Tzah Pahima has released a post explaining the technical details of SynLapse (CVE-2022-29972), a critical vulnerability in Microsoft Azure that also affected Azure Data Factory, and allowed attackers to bypass tenant separation.
As noted by Pahima, a successful exploitation of SynLapse could have allowed attackers to obtain credentials to other Azure Synapse customer accounts, control their Azure Synapse workspaces, execute code on targeted customer machines inside the Azure Synapse Analytics service, and leak customer credentials to data sources external to Azure.
Microsoft had a little trouble delivering a complete patch – it was bypassed twice by the researchers – but ultimately mitigated it in April. Since it affected Azure Data Factory or Azure Synapse pipeline customers hosted in the Azure cloud (Azure Integration Runtime) and those hosted on-premises (Self-Hosted Integration Runtime), the researchers waited with the release of the technical details until the latter had a chance to patch their on-premises versions. If you’re one of those and you have yet to implement the fix, you should do it now.
Finally, you should also get a move on if your organization hasn’t prepared for tomorrow’s retirement of Internet Explorer.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/06/14/microsoft-fixes-follina-and-55-other-cves/