Our monthly summary of recent important security patches includes updates from Microsoft and HP

Microsoft Patch Tuesday March 2022

The March security updates from Microsoft address 71 security vulnerabilities, including several rated as critical or zero-day:

Microsoft Exchange Server remote code execution vulnerability ( CVE-2022-23277) allowing an authenticated malicious user to run their code with admin rights on the server

Remote Desktop Client Remote Code Execution Vulnerability (CVE-2022-21990) has been publicly disclosed.  A threat actor can trigger code execution on the RDP client by tricking them to connect to a malicious RDP server controlled by the attacker.

Windows SMBv3 Client/Server Remote Code Execution Vulnerability (CVE-2022-24508) affects Windows 10 version 2004 and newer and can be used to facilitate lateral movement around your network by an attacker that has gained access.

Video codec remote code execution vulnerabilities (CVE-2022-22006 and CVE-2022-24501)

A full list of the updates available from Microsoft is here.

HP patches EFI Firmware

In February security firm Binarly published details of 23 serious vulnerabilities found in the firmware for systems from Fujitsu, Siemens, Dell, HP, HPE, Lenovo, Microsoft, Intel and Bull Atos which all used the same UEFI firmware from InsydeH20.  All the firms had made use of sample code which contained vulnerabilities.

Additional details have now been published for 16 high severity firmware vulnerabilities that impact HP enterprise products including laptops, point of sale systems, desktops and edge computing nodes.

HP has issued two security advisories HPSBHF03765 and HPSBHF03776 which provide links to download the updated firmware as it becomes available over the coming weeks.

Malware that targets UEFI firmware (such as Moonbounce) is not detectable by many anti-malware products because of where it hides on the system, requiring security managers to adopt new tools and controls to protect the firmware of systems on their networks.