Microsoft Patch Tuesday 03/09/2022 Notes

Microsoft Patch Tuesday 03/09/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
• Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for March 2022 contained 71 vulnerabilities in total, with:

• 3 vulnerabilities rated as Critical
• 68 vulnerabilities rated as Important

Most notable vulnerabilities

Microsoft has listed 3 publicly disclosed zero-day vulnerabilities (CVE-2022-21990, CVE-2022-24459, and CVE-2022-24512) among the bugs fixed in the March Patch Tuesday security update. None of these vulnerabilities are actively exploited in the wild. However, public proof-of-concept exploits are available for CVE-2022-21990 and CVE-2022-24459.

The critical bugs patched in this batch of updates are tracked as CVE-2022-22006, CVE-2022-24501, and CVE-2022-23277. All of them can lead to remote code execution in the event of a successful attack.

CVE-2022-21990

CVE-2022-21990 (CVSS score: 8.8) is a Security Bypass vulnerability in the Remote Desktop Client. Because of this flaw, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system – after persuading a victim to open specially-crafted content.

The following products are affected:

• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Remote Desktop client for Windows Desktop
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-24459

CVE-2022-24459 (CVSS score: 7.8) is a Privilege Escalation vulnerability in the Windows Fax and Scan Service. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, as a result of this bug. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 10 for 32-bit Systems
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems

CVE-2022-24512

CVE-2022-24512 (CVSS score: 6.3) is a Security Bypass vulnerability in Microsoft .NET and Visual Studio. As a consequence of this vulnerability, the Microsoft .NET framework could allow a remote authenticated attacker to execute arbitrary code on the system – after sending a specially-crafted request.

The following products are affected:

• Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
• Microsoft Visual Studio 2019 version 16.7 (includes 16.0 - 16.6)
• .NET Core 3.1
• .NET 6.0
• .NET 5.0
• Microsoft Visual Studio 2022 version 17.0
• Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

CVE-2022-24501

CVE-2022-24501 (CVSS score: 7.8) is a Security Bypass vulnerability in VP9 Video Extensions. Because of this bug, Microsoft VP9 Video Extensions could allow a remote attacker to execute arbitrary code on the system – by persuading a victim to open specially-crafted content.

The following product is affected:

• VP9 Video Extensions

CVE-2022-23277

CVE-2022-23277 (CVSS score: 8.8) is a Security Bypass vulnerability in Microsoft Exchange Server. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, after the attacker sends a specially-crafted request.

The following products are affected:

• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2016 Cumulative Update 22
• Microsoft Exchange Server 2019 Cumulative Update 10
• Microsoft Exchange Server 2016 Cumulative Update 21
• Microsoft Exchange Server 2013 Cumulative Update 23

CVE-2022-22006

CVE-2022-22006 (CVSS score: 7.8) is a Security Bypass vulnerability in HEVC Video Extensions. As a result of this bug, Microsoft HEVC Video Extensions could allow a remote attacker to execute arbitrary code on the system – by persuading a victim to open specially-crafted content.

The following product is affected:

• HEVC Video Extension

CVE-2022-24508

CVE-2022-24508 (CVSS score: 8.8) is a Security Bypass vulnerability in Windows SMBv3 Client/Server. Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code, because of an error in the SMBv3 Client/Server. By sending a specially-crafted SMB packet to a computer connected to an SMB Server, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Azure Edition Core Hotpatch
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems

Users should apply the latest security patches specified in Microsoft's March Patch Tuesday update and follow the recommended mitigations and workarounds to protect themselves from these and other vulnerabilities.