August 15, 2022

TheCyberThrone

Thinking Security ! Always

Microsoft Patch Tuesday July 2022

Microsoft patched 84 CVEs in its July 2022 Patch Tuesday release, with four rated as critical, 79 rated as important and one rated as unknown.

This month’s update includes patches for:

  • AMD CPU Branch
  • Azure Site Recovery
  • Azure Storage Library
  • Microsoft Defender for Endpoint
  • Microsoft Edge (Chromium-based)
  • Microsoft Graphics Component
  • Microsoft Office
  • Open-Source Software
  • Role: DNS Server
  • Role: Windows Fax Service
  • Role: Windows Hyper-V
  • Skype for Business and Microsoft Lync
  • Windows Active Directory
  • Windows Advanced Local Procedure Call
  • Windows BitLocker
  • Windows Boot Manager
  • Windows Client/Server Runtime Subsystem
  • Windows Connected Devices Platform Service
  • Windows Credential Guard
  • Windows Fast FAT Driver
  • Windows Fax and Scan Service
  • Windows Group Policy
  • Windows IIS
  • Windows Kernel
  • Windows Media
  • Windows Network File System
  • Windows Performance Counters
  • Windows Point-to-Point Tunnelling Protocol
  • Windows Portable Device Enumerator Service
  • Windows Print Spooler Components
  • Windows Remote Procedure Call Runtime
  • Windows Security Account Manager
  • Windows Server Service
  • Windows Shell
  • Windows Storage
  • Xbox
Advertisements

Azure Site Recovery Elevation of Privilege Vulnerability

CVE-2022-33675 is an EoP vulnerability in Azure Site Recovery, a suite of tools aimed at providing disaster recovery services. It exists due to a directory permission error which can allow an attacker to use DLL hijacking to elevate their privileges to the SYSTEM

Windows CSRSS Elevation of Privilege

CVE-2022-22047 is an EoP vulnerability in the Windows Client Server Run-Time Subsystem with a CVSSv3 score of 7.8 and is rated as Important. Microsoft says this vulnerability has been exploited in the wild, though no further details have been shared at the time of publication. However, this type of vulnerability is likely to have been used as part of post-compromise activity once an attacker has gained access to their targeted system and run a specially crafted application.

Windows Print Spooler Elevation of Privilege Vulnerabilities

CVE-2022-22022, CVE-2022-22041, CVE-2022-30206, and CVE-2022-30226 are all EoP vulnerabilities in Windows Print Spooler Components. After the deluge of vulnerability disclosures kicked off by PrintNightmare in August 2021, June 2022 was the first month in which Microsoft did not release any patches for Print Spooler. On balance, Microsoft has patched four high severity vulnerabilities in the service, all of which were rated “Exploitation Less Likely” based on Microsoft’s Exploitability Index.

CVE IDDescriptionCVSS
CVE-2022-22022Windows Print Spooler Elevation of Privilege7.1
CVE-2022-22041Windows Print Spooler Elevation of Privilege7.2
CVE-2022-30206Windows Print Spooler Elevation of Privilege7.8
CVE-2022-30226Windows Print Spooler Elevation of Privilege7.1

If patching is not feasible at this time, all four vulnerabilities can be mitigated by disabling the Print Spooler service.

Advertisements

Remote Procedure Call Runtime Remote Code Execution Vulnerability

CVE-2022-22038 is an RCE vulnerability in the Remote Procedure Call Runtime impacting all supported versions of Windows. The vulnerability received a CVSSv3 score of 8.1 and, while no privileges are required, the CVSS score indicates the attack complexity is high. Microsoft further supports this with a note in the advisory stating that additional actions by an attacker are required to prepare a target for successful exploitation.

Windows Network File System Vulnerabilities

CVE-2022-22028 is an information disclosure vulnerability, while CVE-2022-22029 and CVE-2022-22039are RCE vulnerabilities in the Windows Network File System (NFS) and Exploitation Less Likely because these flaws have high attack complexity. In the case of CVE-2022-22029, an attacker would need to invest time in repeated exploitation attempts by sending constant or intermittent data. Both CVE-2022-22028 and CVE-2022-22039 require an attacker to win a race condition to exploit these vulnerabilities.

Chromium Edge

Earlier in July, Microsoft released Microsoft Edge (Chromium-based) vulnerabilities CVE-2022-2294 and CVE-2022-2295. The vulnerability assigned to each of these CVEs is in the Chromium Open Source Software (OSS) which is consumed by Microsoft Edge. It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. 

Advertisements
CVE IDDescriptionSeverity
CVE-2022-23825AMD: CVE-2022-23825 AMD CPU Branch Type ConfusionImportant
CVE-2022-23816AMD: CVE-2022-23816 AMD CPU Branch Type ConfusionImportant
CVE-2022-33665Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33666Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33663Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33664Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33667Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33672Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33673Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33671Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33668Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33661Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33662Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33657Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33656Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33658Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33660Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33659Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33655Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33651Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33650Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33652Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33654Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33653Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33669Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33643Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-30181Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33676Azure Site Recovery Remote Code Execution VulnerabilityImportant
CVE-2022-33677Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33678Azure Site Recovery Remote Code Execution VulnerabilityImportant
CVE-2022-33642Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33674Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33675Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-33641Azure Site Recovery Elevation of Privilege VulnerabilityImportant
CVE-2022-30187Azure Storage Library Information Disclosure VulnerabilityImportant
CVE-2022-33637Microsoft Defender for Endpoint Tampering VulnerabilityImportant
CVE-2022-2295Chromium: CVE-2022-2295 Type Confusion in V8Unknown
CVE-2022-2294Chromium: CVE-2022-2294 Heap buffer overflow in WebRTCUnknown
CVE-2022-22034Windows Graphics Component Elevation of Privilege VulnerabilityImportant
CVE-2022-30213Windows GDI+ Information Disclosure VulnerabilityImportant
CVE-2022-30221Windows Graphics Component Remote Code Execution VulnerabilityCritical
CVE-2022-33632Microsoft Office Security Feature Bypass VulnerabilityImportant
CVE-2022-27776HackerOne: CVE-2022-27776 Insufficiently protected credentials vulnerability might leak authentication or cookie header dataImportant
CVE-2022-30214Windows DNS Server Remote Code Execution VulnerabilityImportant
CVE-2022-22024Windows Fax Service Remote Code Execution VulnerabilityImportant
CVE-2022-22027Windows Fax Service Remote Code Execution VulnerabilityImportant
CVE-2022-30223Windows Hyper-V Information Disclosure VulnerabilityImportant
CVE-2022-22042Windows Hyper-V Information Disclosure VulnerabilityImportant
CVE-2022-33633Skype for Business and Lync Remote Code Execution VulnerabilityImportant
CVE-2022-30215Active Directory Federation Services Elevation of Privilege VulnerabilityImportant
CVE-2022-30202Windows Advanced Local Procedure Call Elevation of Privilege VulnerabilityImportant
CVE-2022-30224Windows Advanced Local Procedure Call Elevation of Privilege VulnerabilityImportant
CVE-2022-22037Windows Advanced Local Procedure Call Elevation of Privilege VulnerabilityImportant
CVE-2022-22711Windows BitLocker Information Disclosure VulnerabilityImportant
CVE-2022-22048BitLocker Security Feature Bypass VulnerabilityImportant
CVE-2022-30203Windows Boot Manager Security Feature Bypass VulnerabilityImportant
CVE-2022-22026Windows CSRSS Elevation of Privilege VulnerabilityImportant
CVE-2022-22049Windows CSRSS Elevation of Privilege VulnerabilityImportant
CVE-2022-22047Windows CSRSS Elevation of Privilege VulnerabilityImportant
CVE-2022-30212Windows Connected Devices Platform Service Information Disclosure VulnerabilityImportant
CVE-2022-22031Windows Credential Guard Domain-joined Public Key Elevation of Privilege VulnerabilityImportant
CVE-2022-22043Windows Fast FAT File System Driver Elevation of Privilege VulnerabilityImportant
CVE-2022-22050Windows Fax Service Elevation of Privilege VulnerabilityImportant
CVE-2022-30205Windows Group Policy Elevation of Privilege VulnerabilityImportant
CVE-2022-30209Windows IIS Server Elevation of Privilege VulnerabilityImportant
CVE-2022-22025Windows Internet Information Services Cachuri Module Denial of Service VulnerabilityImportant
CVE-2022-22040Internet Information Services Dynamic Compression Module Denial of Service VulnerabilityImportant
CVE-2022-21845Windows Kernel Information Disclosure VulnerabilityImportant
CVE-2022-22045Windows.Devices.Picker.dll Elevation of Privilege VulnerabilityImportant
CVE-2022-30225Windows Media Player Network Sharing Service Elevation of Privilege VulnerabilityImportant
CVE-2022-22029Windows Network File System Remote Code Execution VulnerabilityCritical
CVE-2022-22028Windows Network File System Information Disclosure VulnerabilityImportant
CVE-2022-22039Windows Network File System Remote Code Execution VulnerabilityCritical
CVE-2022-22036Performance Counters for Windows Elevation of Privilege VulnerabilityImportant
CVE-2022-30211Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution VulnerabilityImportant
CVE-2022-22023Windows Portable Device Enumerator Service Security Feature Bypass VulnerabilityImportant
CVE-2022-30206Windows Print Spooler Elevation of Privilege VulnerabilityImportant
CVE-2022-30226Windows Print Spooler Elevation of Privilege VulnerabilityImportant
CVE-2022-22022Windows Print Spooler Elevation of Privilege VulnerabilityImportant
CVE-2022-22041Windows Print Spooler Elevation of Privilege VulnerabilityImportant
CVE-2022-22038Remote Procedure Call Runtime Remote Code Execution VulnerabilityCritical
CVE-2022-30208Windows Security Account Manager (SAM) Denial of Service VulnerabilityImportant
CVE-2022-30216Windows Server Service Tampering VulnerabilityImportant
CVE-2022-30222Windows Shell Remote Code Execution VulnerabilityImportant
CVE-2022-30220Windows Common Log File System Driver Elevation of Privilege VulnerabilityImportant
CVE-2022-33644Xbox Live Save Service Elevation of Privilege VulnerabilityImportant
%d bloggers like this: