Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Microsoft’s March 2022 Patch Tuesday Addresses 71 CVEs (CVE-2022-23277, CVE-2022-24508)

Microsoft addresses 71 CVEs in its March 2022 Patch Tuesday release, including three vulnerabilities that were publicly disclosed as zero-days.

  1. 3Critical
  2. 68Important
  3. 0Moderate
  4. 0Low

Microsoft patched 71 CVEs in the March 2022 Patch Tuesday release, with three rated as critical and 68 rated as important.

This month’s update includes patches for:

  • .NET and Visual Studio
  • Azure Site Recovery
  • Microsoft Defender for Endpoint
  • Microsoft Defender for IoT
  • Microsoft Edge (Chromium-based)
  • Microsoft Exchange Server
  • Microsoft Intune
  • Microsoft Office Visio
  • Microsoft Office Word
  • Microsoft Windows ALPC
  • Microsoft Windows Codecs Library
  • Paint 3D
  • Role: Windows Hyper-V
  • Skype Extension for Chrome
  • Tablet Windows User Interface
  • Visual Studio Code
  • Windows Ancillary Function Driver for WinSock
  • Windows CD-ROM Driver
  • Windows Cloud Files Mini Filter Driver
  • Windows COM
  • Windows Common Log File System Driver
  • Windows DWM Core Library
  • Windows Event Tracing
  • Windows Fastfat Driver
  • Windows Fax and Scan Service
  • Windows HTML Platform
  • Windows Installer
  • Windows Kernel
  • Windows Media
  • Windows PDEV
  • Windows Point-to-Point Tunneling Protocol
  • Windows Print Spooler Components
  • Windows Remote Desktop
  • Windows Security Support Provider Interface
  • Windows SMB Server
  • Windows Update Stack
  • XBox
  • Remote code execution (RCE) vulnerabilities accounted for 40.8% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 35.2%.

    Critical

    CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability

    CVE-2022-23277 is a critical RCE vulnerability in Microsoft Exchange Server. An authenticated user can exploit this vulnerability to execute arbitrary code on an affected server. According to Microsoft’s Exploitability Index rating, this vulnerability is rated Exploitation More Likely. Threat actors continue to target Exchange servers, particularly through the exploitation of ProxyLogon (CVE-2021-26855), rated as the number one vulnerability in our 2021 Threat Landscape Retrospective. With Exchange vulnerabilities being actively targeted, organizations should prioritize patching this flaw.

    Important

    CVE-2022-23285 and CVE-2022-21990 | Remote Desktop Client Remote Code Execution Vulnerability

    CVE-2022-23285 and CVE-2022-21990 are RCE vulnerabilities in the Remote Desktop Client. Both flaws were assigned a CVSSv3 score of 8.8 and were rated Exploitation More Likely. To exploit these vulnerabilities, an attacker would need to convince a user to connect to a malicious, attacker-controlled server. Successful exploitation would grant an attacker remote code execution on the client’s system, which they could then use to perform a variety of actions, such as installing programs, accessing, modifying or removing data from the system or creating a new account with full privileges.Microsoft notes that CVE-2022-21990 was publicly disclosed prior to a patch being made available.

    Important

    CVE-2022-24508 | Windows SMBv3 Client/Server Remote Code Execution Vulnerability

    CVE-2022-24508 is a RCE vulnerability in the Microsoft Server Message Block 3.0 (SMBv3) Client and Server. Microsoft notes that this vulnerability was introduced in Windows 10 version 2004 so only newer supported versions of Windows are affected. While an attacker must be authenticated to exploit this vulnerability, Microsoft strongly recommends patching or applying the suggested workarounds as soon as possible.

    In addition, Microsoft notes that exploitation is more likely for this vulnerability and has provided some recommended actions for protecting networks as well as a workaround that can be utilized for organizations that are not able to immediately patch.

    The vulnerability is reminiscent of flaws in SMBv1 patched in MS17-010 in March of 2017. Mass exploitation of that vulnerability was observed in the wild by the WannaCry ransomware, which remains one of the most destructive malware events to date. It remains unclear if CVE-2022-24508 will see exploitation, however patching should be prioritized for all organizations with affected systems.

    Important

    CVE-2022-24459 | Windows Fax and Scan Service Elevation of Privilege Vulnerability

    CVE-2022-24459 is a privilege escalation vulnerability affecting the Windows Fax and Scan service. The vulnerability carries a CVSSv3 score of 7.8 and can be exploited by a local, authenticated attacker. While the severity and requirements for exploitation would typically be less concerning, this vulnerability was publicly disclosed. Given that attackers continue to capitalize on known and proven exploitable vulnerabilities, it’s possible that this flaw could make its way into attackers' toolkits in the future. Privilege escalation is a common tactic used after an initial compromise or entry to a network by threat actors.

    Important

    CVE-2022-24512 |.NET and Visual Studio Remote Code Execution Vulnerability

    CVE-2022-24512 is a RCE vulnerability affecting Microsoft.NET and Visual Studio which has been publicly disclosed. According to Microsoft, exploitation of this vulnerability requires user interaction to trigger a payload in an affected application. An attacker would likely use social engineering tactics like phishing to influence the necessary user interaction. In addition, the advisory indicates that an attacker would need to combine this with other vulnerabilities in order to successfully exploit a system and that the ability to exploit this vulnerability by itself is limited.

    Tenable Solutions

    Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains March 2022.

    With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

    A list of all the plugins released for Tenable’s March 2022 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

    Get more information

    Join Tenable's Security Response Team on the Tenable Community.

    Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

    Get a free 30-day trial of Tenable.io Vulnerability Management.

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training