Microsoft Patch Tuesday – September 2022

Microsoft patched 62 CVEs (excluding CVEs for chromium bugs) in its September 2022 Patch Tuesday release, with five rated as critical and 57 rated as important. A lighter one when compared to August 2022.

This month’s update includes patches for below products:

• .NET and Visual Studio
• .NET Framework
• Azure
• Azure Arc
• Cache Speculation
• HTTP.sys
• Microsoft Dynamics
• Microsoft Edge (Chromium-based)
• Microsoft Graphics Component
• Microsoft Office
• Microsoft Office SharePoint
• Microsoft Office Visio
• Microsoft Windows ALPC
• Microsoft Windows Codecs Library
• Network Device Enrollment Service (NDES)
• Role: DNS Server
• Role: Windows Fax Service
• SPNEGO Extended Negotiation
• Visual Studio Code
• Windows Common Log File System Driver
• Windows Credential Roaming Service
• Windows Defender
• Windows Distributed File System (DFS)
• Windows DPAPI (Data Protection Application Programming Interface)
• Windows Enterprise App Management
• Windows Event Tracing
• Windows Group Policy
• Windows IKE Extension
• Windows Kerberos
• Windows Kernel
• Windows LDAP – Lightweight Directory Access Protocol
• Windows ODBC Driver
• Windows OLE
• Windows Photo Import API
• Windows Print Spooler Components
• Windows Remote Access Connection Manager
• Windows Remote Procedure Call
• Windows TCP/IP
• Windows Transport Security Layer (TLS)

Windows Common Log File System Driver EoP  Vulnerability

CVE-2022-37969 is an EoP vulnerability in the Windows Common Log File System (CLFS) Driver. this vulnerability is a post-exploitation bug that has been exploited in the wild and disclosed prior to a patch being available.

CVE-2022-24521, a similar vulnerability in CLFS, was patched earlier this year as part of Microsoft’s April Patch Tuesday release, which was also exploited in the wild. It is unclear currently if CVE-2022-37969 is potentially a patch-bypass for CVE-2022-24521.

Windows TCP/IP RCE Vulnerability

CVE-2022-34718 is an RCE in Windows TCP/IP with a CVSSv3 score of 9.8 and was rated Exploitation More Likely. This vulnerability can only be exploited against systems with Internet Protocol Security (IPsec) enabled. Successful exploitation could grant an unauthenticated attacker remote code execution. Microsoft has released patches for all supported versions of Windows, including Server Core editions.

Windows Internet Key Exchange (IKE) Protocol Extensions RCE Vulnerability

CVE-2022-34721 and CVE-2022-34722 are RCE vulnerabilities in the Windows IKE protocol extensions with a CVSSv3 score of 9.8 and were rated Exploitation Less Likely.

The IKE protocol is a component of IPsec used to set up security associations. These vulnerabilities would allow an unauthenticated, remote attacker to send a specially crafted IP packet to a target with IPsec enabled and achieve remote code execution. IPsec is used to protect sensitive data and is commonly used in virtual private networks. CVE-2022-34720, a DoS flaw in the IKE Protocol Exchange, and CVE-2022-35830, an RCE vulnerability in the Remote Procedure Call runtime.

Windows Kernel EoP Vulnerability

CVE-2022-37956, CVE-2022-37957, and CVE-2022-37964 are EoP vulnerabilities impacting the Windows Kernel. CVSSv3 score is 7.8 for all three vulnerabilities and if exploited, could allow an attacker to gain SYSTEM level privileges. Of the three, only CVE-2022-37957 was rated as Exploitation More Likely. All three impact various versions of Windows.

Microsoft Dynamics 365 Vulnerabilities

Two other critical vulnerabilities, CVE-2022-35805 and CVE-2022-34700 exist in on-premises instances of Microsoft Dynamics 365. An authenticated attacker could exploit these vulnerabilities to run a specially crafted trusted solution package and execute arbitrary SQL commands. The attacker could escalate their privileges further and execute commands as the database owner.

SharePoint Vulnerabilities

Four SharePoint remote code execution vulnerabilities, CVE-2022-35823,  CVE-2022-38008,  CVE-2022-38009, and CVE-2022-37961, would likely be exploited by an attacker that already has initial access to move laterally across the network. The bugs could impact organizations that use SharePoint for internal wikis or document stores, and attackers could exploit them to steal confidential information, replace documents with new versions that contain malicious code or inject macros to infect other systems.

Other notable bugs

• CVE-2022-34724 – Windows DNS Server Denial of Service Vulnerability
• CVE-2022-3075 – Chromium: CVE-2022-3075 Insufficient data validation in Mojo

Vulnerabilities summary