Microsoft Releases Fix for New Zero-Day with May 2022 Patch Tuesday Updates

Microsoft on Tuesday rolled out fixes for as numerous as 74 security vulnerabilities, which include just one for a zero-working day bug which is remaining actively exploited in the wild.

Of the 74 issues, seven are rated Critical, 66 are rated Vital, and one is rated low in severity. Two of the flaws are shown as publicly regarded at the time of release.

These encompass 24 remote code execution (RCE), 21 elevation of privilege, 17 details disclosure, and 6 denial-of-company vulnerabilities, between many others. The updates are in addition to 36 flaws patched in the Chromium-centered Microsoft Edge browser on April 28, 2022.

Chief between the fixed bugs is CVE-2022-26925 (CVSS rating: 8.1), a spoofing vulnerability affecting the Windows Area Security Authority (LSA), which Microsoft describes as a “safeguarded subsystem that authenticates and logs people on to the area procedure.”

“An unauthenticated attacker could contact a method on the LSARPC interface and coerce the area controller to authenticate to the attacker employing NTLM,” the corporation stated. “This security update detects anonymous relationship attempts in LSARPC and disallows it.”

It’s also truly worth noting that the CVSS severity score of the flaw would be elevated to 9.8 should it be blended with NTLM relay attacks like PetitPotam, producing it a critical issue.

“Remaining actively exploited in the wild, this exploit allows an attacker to authenticate as accepted end users as section of an NTLM relay attack – permitting risk actors get access to the hashes of authentication protocols,” Kev Breen, director of cyber menace study at Immersive Labs, claimed.

The two other publicly-regarded vulnerabilities are as follows –

• CVE-2022-29972 (CVSS score: 8.2) – Perception Software: CVE-2022-29972 Magnitude Simba Amazon Redshift ODBC Driver (aka SynLapse)
• CVE-2022-22713 (CVSS score: 5.6) – Windows Hyper-V Denial-of-Company Vulnerability

Microsoft, which remediated CVE-2022-29972 on April 15, tagged it as “Exploitation Much more Probable” on the Exploitability Index, building it crucial influenced buyers apply the updates as shortly as attainable.

Also patched by Redmond are a number of RCE bugs in Windows Network File Method (CVE-2022-26937), Windows LDAP (CVE-2022-22012, CVE-2022-29130), Windows Graphics (CVE-2022-26927), Windows Kernel (CVE-2022-29133), Remote Technique Connect with Runtime (CVE-2022-22019), and Visual Studio Code (CVE-2022-30129).

Cyber-Kunlun, a Beijing-centered cybersecurity firm, has been credited with reporting 30 of the 74 flaws, counting CVE-2022-26937, CVE-2022-22012, and CVE-2022-29130.

What is more, CVE-2022-22019 adopted an incomplete patch for 3 RCE issues in the Distant Process Contact (RPC) runtime library past thirty day period — CVE-2022-26809, CVE-2022-24492, and CVE-2022-24528 — that were tackled by Microsoft in April 2022.

Exploiting the flaw would enable a remote, unauthenticated attacker to execute code on the vulnerable machine with the privileges of the RPC service, Akamai claimed.

The Patch Tuesday update is also notable for resolving two privilege escalation (CVE-2022-29104 and CVE-2022-29132) and two info disclosure (CVE-2022-29114 and CVE-2022-29140) vulnerabilities in the Print Spooler component, which has extended posed an beautiful concentrate on for attackers.

Application Patches from Other Vendors

Besides Microsoft, security updates have also been introduced by other vendors considering the fact that the get started of the thirty day period to rectify many vulnerabilities, which include —

• Adobe
• AMD
• Android
• Cisco
• Citrix
• Dell
• F5
• Google Chrome
• HP
• Intel
• Linux distributions Debian, Oracle Linux, Red Hat, SUSE, and Ubuntu
• MediaTek
• Mozilla Firefox, Firefox ESR, and Thunderbird
• Qualcomm
• SAP
• Schneider Electrical, and
• Siemens

Observed this short article fascinating? Stick to THN on Facebook, Twitter  and LinkedIn to read through much more unique material we post.

Some components of this report are sourced from:
thehackernews.com