Microsoft Patch Tuesday 11/09/2022 Notes

Microsoft Patch Tuesday 11/09/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for November 2022 contained 68 vulnerabilities in total, with:

• 11 vulnerabilities rated as Critical
• 6 zero-day vulnerabilities, all of which are actively exploited

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

This month’s security updates contain patches for a previously disclosed and reported bug (CVE-2022-41091) – a Security Feature Bypass of “Windows Mark of the Web,” which flags files from untrusted sources. This batch of security updates also includes fixes for the set of vulnerabilities dubbed ProxyNotShell (CVE-2022-41040 and CVE-2022-41082).

Most notable vulnerabilities

Microsoft has listed six zero-day vulnerabilities (CVE-2022-41128, CVE-2022-41073, CVE-2022-41125, CVE-2022-41091, CVE-2022-41040, and CVE-2022-41082) among the bugs fixed in the November Patch Tuesday security update. All of these zero-day vulnerabilities are being actively exploited in the wild.

CVE-2022-41128

CVE-2022-41128 (CVSS score: 8.8) is a Security Bypass vulnerability. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, because of a flaw in the Network Scripting Languages component. By persuading a victim to open a specially crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Windows Server 2012 R2
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41073

CVE-2022-41073 (CVSS score: 7.8) is a Privilege Escalation bug. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, because of a flaw in the Print Spooler component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41125

CVE-2022-41125 (CVSS score: 7.8) is an elevation of privilege vulnerability. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the CNG Key Isolation Service component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41091

CVE-2022-41091 (CVSS score: 5.4) is a Security Bypass vulnerability. Microsoft Windows could allow a remote attacker to bypass security restrictions, caused by a flaw in the Mark of the Web Security feature. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to bypass security features.

The following products are affected:

• Windows 10 Version 22H2 for x64-based Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition (Hotpatch)
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-41040

CVE-2022-41040 (CVSS score: 8.8) is a Security Bypass vulnerability. Microsoft Exchange Server can be vulnerable to server-side request forgery (SSRF), because of improper validation of user-supplied input within the Exchange OWA interface. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to conduct an SSRF attack.

The following products are affected:

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2016 Cumulative Update 22
• Microsoft Exchange Server 2013 Cumulative Update 23

CVE-2022-41082

CVE-2022-41082 (CVSS score: 8.8) is a Security Bypass vulnerability. Microsoft Exchange Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw when PowerShell is accessible. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2016 Cumulative Update 22
• Microsoft Exchange Server 2013 Cumulative Update 23

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.