The second Tuesday of February brings the monthly security updates from Microsoft.
Microsoft Security Updates – February 2022
February is a relatively modest month for Microsoft with just 51 security patches released. Even though none of this month’s vulnerabilities are rated as Critical, there is a trio of remote code execution vulnerabilities. Historically February is usually a relatively quiet month from Microsoft.
Three of the notable fixes from Microsoft this month include:
Hyper-V Remote Code Execution vulnerability – CVE-2022-21995
This is a guest-to-host escape affecting Hyper-V server
Sharepoint Server Remote Code Execution vulnerability – CVE-2022-22005
An authenticated user with the ‘manage lists’ permission could exploit this vulnerability to execute any arbitrary .NET code on the server using the service account of the SharePoint Web Application.
DNS Server Remote Code Execution Vulnerability – CVE-2022-21984
If Dynamic updates have been enabled on your Windows DNS Server, an attacker could execute arbitrary code on the server with elevated privileges.
CISA Issues warning for exploited vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) in the USA has issued a warning that a bug which was patched in Microsoft’s January release is under active attack.
CISA maintains a useful list of exploits which are known to be under active attack, guiding Security Managers to ensure these attack vectors are promptly resolved on their networks.
CVE-2022-21882 has just been added to the Known Exploited Vulnerabilities Catalog and is so dangerous that federal agencies have been mandated to ensure it is patched by 18th February 2022. The bug is a privilege escalation vulnerability affected the Win32k Windows Kernel. Microsoft warns that: A local, authenticated attacker could gain elevated local system or administrator privileges through a vulnerability in the Win32k.sys driver.
Networks that have not yet applied the January security patches are advised to review this alert and prioritise the patch implementation.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)