Microsoft has issued fixes for two zero-day vulnerabilities in its final Patch Tuesday of the year.
In its latest bulletin, Microsoft said it will roll out security updates for a number of operating system components and software products, including Azure, Microsoft Dynamics, Windows Kernel, and SmartScreen.
The update batch includes 49 patched vulnerabilities, six of which are rated critical, and one that researchers identified as having been actively exploited.
This potentially exploited bug, tracked as CVE-2022-44698, affects Windows SmartScreen and would enable threat actors to bypass Mark of the Web (MOTW) protocols.
“An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging,” Microsoft revealed in its security update.
Microsoft clarified that this particular flaw could be exploited in web-based attack scenarios whereby an attacker hosts a malicious website designed specifically to evade security protocols.
Similarly, attackers could leverage email or instant messaging to compromise users by sending a specially crafted .url file.
Microsoft also disclosed a second critical vulnerability, CVE-2022-44710, affecting the DirectX graphics kernel on Windows 11 22H2 systems. This was identified as an elevation of privilege vulnerability that, if successfully exploited, could enable an attacker to gain system privileges.
While recent observation reveals this has not been actively exploited, Microsoft gave the flaw a CVSS rating of 7.8, meaning it is high on the severity scale.
Critical Vulnerabilities
Microsoft has issued patches for all six critical flaws identified in its latest bulletin, which include:
CVE-2022-41127 (Microsoft Dynamics)
CVE-2022-44670 (Windows Secure Socket Tunneling Protocol)
CVE-2022-44676 (Windows Secure Socket Tunneling Protocol)
CVE-2022-41076 (PowerShell)
CVE-2022-44690 (SharePoint)
CVE-2022-44693 (SharePoint)
Greg Wiseman, lead product manager at Rapid7, told IT Pro that administrators for SharePoint and Microsoft Dynamics “should be aware of Critical Remote Code Execution (RCE) vulnerabilities” and implement patches immediately.
Patch Tuesday
Microsoft’s final Patch Tuesday of 2022 appears to have been a relatively light month in comparison to November.
Last month saw fixes for six exploited zero-day vulnerabilities and the disclosure of 68 flaws, 11 of which were classified as critical and allowed privilege elevation and remote code execution.
RELATED RESOURCE
However, Mark Lamb, CEO of HighGround.io, warned that organisations should remain vigilant and prioritise patches to mitigate potential risks.
“It’s the last Patch Tuesday of 2022, and while not as major as last month’s update, we are still finishing the year off with a bang,” he said.
“Two zero-days and six critical flaws, which provide criminals with remote code execution, privileged access and denial of service, among other things. This means a major update and organisations must apply patches as soon as possible,” Lamb added.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
A journey to cyber resiliencewhitepaper DORA: Ushering in a new era of cyber security
