• Menu
  • Skip to main content
  • Skip to primary sidebar

The Cyber Security News

Latest Cyber Security News

Header Right

  • Latest News
  • Vulnerabilities
  • Cloud Services
Cyber Security News

CISA Urges Patch of Exploited Windows 11 Bug by Aug. 2

You are here: Home / Latest Cyber Security Vulnerabilities / CISA Urges Patch of Exploited Windows 11 Bug by Aug. 2
July 18, 2022

Feds urge U.S. organizations to patch a Microsoft July Patch Tuesday 2022 bug that is staying exploited in the wild by August 2.

A Windows 11 vulnerability, part of Microsoft’s Patch Tuesday roundup of fixes, is getting exploited in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Company (CISA) to advise patching of the elevation of privileges flaw by August 2.

The recommendation is directed at federal companies and issues CVE-2022-22047, a vulnerability that carries a CVSS score of higher (7.8) and exposes Windows Shopper Server Runtime Subsystem (CSRSS) made use of in Windows 11 (and before variations courting again to 7) and also Windows Server 2022 (and earlier versions 2008, 2012, 2016 and 2019) to attack.

✔ Approved From Our Partners
AOMEI Backupper Lifetime

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code


[FREE On-demand Event: Join Keeper Security’s Zane Bond in a Threatpost roundtable and learn how to securely access your machines from anywhere and share sensitive documents from your home office. WATCH HERE.]

The CSRSS bug is an elevation of privileges vulnerability that will allow adversaries with a pre-set up foothold on a targeted program to execute code as an unprivileged consumer. When the bug was very first noted by Microsoft’s individual security team before this month it was classified as a zero-working day, or a recognised bug with no patch. That patch was designed available on Tuesday July 5.

Researchers at FortiGuard Labs, a division of Fortinet, said the menace the bug poses to small business is “medium”. In a bulletin, scientists reveal the downgraded rating since an adversary requires state-of-the-art “local” or bodily access to the qualified program to exploit the bug and a patch is available.

That mentioned, an attacker who has previously acquired remote obtain to a computer system program (via malware an infection) could exploit the vulnerability remotely.

“Although there is no more information on exploitation unveiled by Microsoft, it can be surmised that an unknown distant code execution permitted for an attacker to carry out lateral motion and escalate privileges on devices vulnerable to CVE-2022-22047, eventually permitting for Technique privileges,” FortiGuard Labs wrote.

Business and Adobe Files Entry Points

Although the vulnerability is becoming actively exploited, there are no recognised public proof of principle exploits in the wild that can be employed to help mitigate or from time to time gas attacks, according to a report by The File.

“The vulnerability allows an attacker to execute code as Technique, offered they can execute other code on the concentrate on,” wrote Development Micro’s Zero Day Initiative (ZDI) in its Patch Tuesday roundup last week.

“Bugs of this kind are generally paired with a code execution bug, typically a specially crafted Place of work or Adobe document, to get around a method. These attacks generally depend on macros, which is why so many had been disheartened to listen to Microsoft’s hold off in blocking all Workplace macros by default,” wrote ZDI creator Dustin Childs.

Microsoft lately explained it would block the use of Visual Basic for Apps (VBA) macros by default in some of its Workplace apps, nevertheless set no timeline implement the coverage.

CISA added the Microsoft bug to its jogging record of recognized exploited vulnerabilities on July 7 (lookup “CVE-2022-22047” to find the entry) and recommends merely, “apply updates per seller instructions”.

[FREE On-demand Event: Join Keeper Security’s Zane Bond in a Threatpost roundtable and learn how to securely access your machines from anywhere and share sensitive documents from your home office. WATCH HERE.]

Graphic: Courtesy of Microsoft


Some elements of this article are sourced from:
threatpost.com

Previous Post: «hackers distributing password cracking tool for plcs and hmis to Hackers Distributing Password Cracking Tool for PLCs and HMIs to Target Industrial Systems

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Report This Article

Recent Posts

  • CISA Urges Patch of Exploited Windows 11 Bug by Aug. 2
  • Hackers Distributing Password Cracking Tool for PLCs and HMIs to Target Industrial Systems
  • Public Cloud Customers Admit Security Challenges
  • Roblox hacker posts stolen documents online
  • Juniper Releases Patches for Critical Flaws in Junos OS and Contrail Networking
  • Google Removes “App Permissions” List from Play Store for New “Data Safety” Section
  • Hackers Targeting VoIP Servers By Exploiting Digium Phone Software
  • New Netwrix Auditor Bug Could Let Attackers Compromise Active Directory Domain
  • Average American Accesses Suspicious Sites 6.5 Times a Day
  • DHS Releases Report into Log4j Vulnerabilities and Response

Copyright © TheCyberSecurity.News, All Rights Reserved.