Microsoft Patch Tuesday 12/14/2022 Notes

Microsoft Patch Tuesday 12/14/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for December 2022 involved 48 vulnerabilities in total, with:

• 6 vulnerabilities classified as Critical
• 40 vulnerabilities classified as High, and
• 2 zero-day vulnerabilities, one of which is being actively exploited

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

Most notable vulnerabilities

This month’s security updates include patches for two zero-day bugs: CVE-2022-44698 (Windows SmartScreen Security Feature Bypass Vulnerability, which is being actively exploited in the wild) and CVE-2022-44710 (DirectX Graphics Kernel Elevation of Privilege Vulnerability).

Microsoft also issued patches for other notable bugs such as CVE-2022-41076, CVE-2022-41127, and CVE-2022-44690.

CVE-2022-44698

CVE-2022-44698 (CVSS score: 5.4) is a zero-day vulnerability affecting Windows SmartScreen. Microsoft has released patches for the issue for affected Windows versions starting from Windows 7 and Windows Server 2008 R2. A victim can be lured to visit an infected site or open an attachment in order to bypass the SmartScreen. As this issue is still being exploited in the wild, admins should pay special attention to this patch.

The following products are affected:

• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2022-44710

CVE-2022-44710 (CVSS score: 7.8) is a publicly disclosed privilege vulnerability affecting the DirectX graphics kernel on Windows 11 22H2 systems but not observed to be directly exploited.

The following products are affected:

• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems

CVE-2022-41076

CVE-2022-41076 (CVSS score: 8.5) is a PowerShell Remote Code Execution Vulnerability. This critical bug could potentially allow an unauthenticated attacker to run unapproved commands on an affected system.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 Datacenter: Azure Edition
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems
• PowerShell 7.3
• PowerShell 7.2

CVE-2022-41127

CVE-2022-41127 (CVSS score: 8.5) is a critical vulnerability affecting Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On-Premises). This security flaw could allow an authenticated attacker to run code on a host server.

The following products are affected:

• Microsoft Dynamics 365 Business Central 2021 Release Wave 1
• Microsoft Dynamics 365 Business Central 2022 Release Wave 2
• Microsoft Dynamics 365 Business Central 2021 Release Wave 2
• Microsoft Dynamics 365 Business Central 2022 Release Wave 1
• Microsoft Dynamics 365 Business Central 2020 Release Wave 1
• Microsoft Dynamics 365 Business Central 2020 Release Wave 2
• Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)
• Dynamics 365 Business Central Spring 2019 Update
• Microsoft Dynamics NAV 2018
• Microsoft Dynamics NAV 2017
• Microsoft Dynamics NAV 2016

CVE-2022-44690

CVE-2022-44690 (CVSS score: 8.8) is a RCE vulnerability in Microsoft SharePoint Server. An attacker with the Manage Lists permission in SharePoint could exploit this vulnerability to execute code remotely.

The following products are affected:

• Microsoft SharePoint Foundation 2013 Service Pack 1
• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2013 Service Pack 1
• Microsoft SharePoint Enterprise Server 2016

Users are advised to apply the latest security patches specified in Microsoft's December Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.