Microsoft Patch Tuesday 02/09/2022 Notes

Microsoft Patch Tuesday 02/09/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
• Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for February 2022 contained 48 vulnerabilities in total, with:

• 0 vulnerabilities rated as Critical
• 26 vulnerabilities rated as High

Most notable vulnerabilities

Microsoft has listed one zero-day vulnerability, CVE-2022-21989, among the vulnerabilities fixed in the February Patch Tuesday security update. Threat actors can use this bug for escalation of privilege via the kernel. However, no active exploits have been observed for this vulnerability.

This batch of updates had no vulnerability marked “Critical.”

CVE-2022-21989

CVE-2022-21989 (CVSS severity score: 7.8) is a Privilege Escalation vulnerability in the Windows Kernel. A successful attack via this CVE would allow a local authenticated attacker to gain elevated privileges on the system. By executing a specially-crafted program, an authenticated attacker could exploit this bug and execute arbitrary code with higher privileges.

Microsoft rated this vulnerability as “High” (and not “Critical”) because successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation, to prepare the target environment.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Azure Edition Core Hotpatch
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-21984

CVE-2022-21984 (CVSS severity score: 8.8) is a Remote Code Execution Vulnerability in the Windows DNS Server. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. In a successful attack, Microsoft Windows would allow a remote authenticated attacker to execute arbitrary code on the system.

The following products are affected:

• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Azure Edition Core Hotpatch
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems

CVE-2022-22005

CVE-2022-22005 (CVSS severity score: 8.8) is a Remote Code Execution vulnerability in Microsoft SharePoint Server. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2013 Service Pack 1
• Microsoft SharePoint Enterprise Server 2016

CVE-2022-23256

CVE-2022-23256 (CVSS severity score: 8.1) is a spoofing vulnerability in the Azure Data Explorer. This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks. A successful exploit could allow a remote attacker to conduct spoofing attacks via the Azure Data Explorer.

The following products are affected:

• Azure Data Explorer

CVE-2022-23274

CVE-2022-23274 (CVSS severity score: 8.3) is a Remote Code Execution Vulnerability in Microsoft Dynamics GP. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Microsoft Dynamics GP

Users should apply the latest security patches specified in Microsoft's February Patch Tuesday update and follow the recommended mitigations and workarounds to protect themselves from these and other vulnerabilities.