Microsoft Patch Tuesday March 2022

Microsoft addresses 71 CVEs in its March 2022 Patch Tuesday release, . 41 patches for Microsoft Windows vulnerabilities, three vulnerabilities that were publicly disclosed as zero-days but not actively exploited by attacker

This month’s update includes patches for:

• .NET and Visual Studio
• Azure Site Recovery
• Microsoft Defender for Endpoint
• Microsoft Defender for IoT
• Microsoft Edge (Chromium-based)
• Microsoft Exchange Server
• Microsoft Intune
• Microsoft Office Visio
• Microsoft Office Word
• Microsoft Windows ALPC
• Microsoft Windows Codecs Library
• Paint 3D
• Role: Windows Hyper-V
• Skype Extension for Chrome
• Tablet Windows User Interface
• Visual Studio Code
• Windows Ancillary Function Driver for WinSock
• Windows CD-ROM Driver
• Windows Cloud Files Mini Filter Driver
• Windows COM
• Windows Common Log File System Driver
• Windows DWM Core Library
• Windows Event Tracing
• Windows Fastfat Driver
• Windows Fax and Scan Service
• Windows HTML Platform
• Windows Installer
• Windows Kernel
• Windows Media
• Windows PDEV
• Windows Point-to-Point Tunneling Protocol
• Windows Print Spooler Components
• Windows Remote Desktop
• Windows Security Support Provider Interface
• Windows SMB Server
• Windows Update Stack
• XBox

OS Wise Patch Distribution

• Windows 7 (extended support only): 16 vulnerabilities: 0 critical and 16 important
• Windows 8.1: 22 vulnerabilities: 0 critical and 22 important
• Windows 10 version 1909: 30 vulnerabilities: 0 critical and 30 important
• Windows 10 version 2004, 20H2, 21H1 and 21H2 : 30 vulnerabilities, 0 critical and 30 important
• Windows 11:  27 vulnerabilities, 0 critical and 27 important

Windows Server products

• Windows Server 2008 R2 (extended support only): 15 vulnerabilities: 0 critical and 15 important
• Windows Server 2012 R2: 22 vulnerabilities: 0 critical and 22 important
• Windows Server 2016: 25 vulnerabilities: 0 critical and 25 important
• Windows Server 2019: 28 vulnerabilities:  0critical and 28 important
• Windows Server 2022:  28 vulnerabilities: 0 critical and 28 important

Important Vulnerabilities to be noted

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2022-23277 is a critical RCE vulnerability in Microsoft Exchange Server. An authenticated user can exploit this vulnerability to execute arbitrary code on an affected server. Threat actors continue to target Exchange servers, particularly through the exploitation of Proxy Logon (CVE-2021-26855), rated as the number one vulnerability in our 2021 Threat Landscape Retrospective. With Exchange vulnerabilities being actively targeted, organizations should prioritize patching this flaw.

Remote Desktop Client Remote Code Execution Vulnerability

CVE-2022-23285 and CVE-2022-21990 are RCE vulnerabilities in the Remote Desktop Client. Both flaws were assigned a CVSSv3 score of 8.8. To exploit these vulnerabilities, an attacker would need to convince a user to connect to a malicious, attacker-controlled server. Successful exploitation would grant an attacker remote code execution on the client’s system, which they could then use to perform a variety of actions, such as installing programs, accessing, modifying, or removing data from the system or creating a new account with full privileges. Microsoft notes that CVE-2022-21990 was publicly disclosed prior to a patch being made available.

Windows SMBv3 Client/Server Remote Code Execution Vulnerability

CVE-2022-24508 is a RCE vulnerability in the Microsoft Server Message Block 3.0 (SMBv3) Client and Server. Microsoft notes that this vulnerability was introduced in Windows 10 version 2004 so only newer supported versions of Windows are affected. While an attacker must be authenticated to exploit this vulnerability. The vulnerability is reminiscent of flaws in SMBv1 patched in MS17-010 in March of 2017. Mass exploitation of that vulnerability was observed in the wild by the WannaCry ransomware, which remains one of the most destructive malware events to date. Microsoft strongly recommends patching or applying the suggested workarounds as soon as possible.

Windows Fax and Scan Service Elevation of Privilege Vulnerability

CVE-2022-24459 is a privilege escalation vulnerability affecting the Windows Fax and Scan service. The vulnerability carries a CVSSv3 score of 7.8 and can be exploited by a local, authenticated attacker. While the severity and requirements for exploitation would typically be less concerning, this vulnerability was publicly disclosed. Given that attackers continue to capitalize on known and proven exploitable vulnerabilities, it’s possible that this flaw could make its way into attackers’ toolkits in the future. Privilege escalation is a common tactic used after an initial compromise or entry to a network by threat actors.

NET and Visual Studio Remote Code Execution Vulnerability

CVE-2022-24512 is a RCE vulnerability affecting Microsoft.NET and Visual Studio which has been publicly disclosed. This requires user interaction to trigger a payload in an affected application. An attacker would likely use social engineering tactics like phishing to influence the necessary user interaction. In addition, the advisory indicates that an attacker would need to combine this with other vulnerabilities to successfully exploit a system and that the ability to exploit this vulnerability by itself is limited.