Microsoft just patched a whole load of new security flaws, so update now
Almost 70 flaws fixed by Microsoft in another busy month
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
This month’s Patch Tuesday has seenMicrosoftunveil fixes to dozens of vulnerabilities, some of which are critical, and one of which is being actively exploited in the wild.
The flaws are found in various versions of Windows, .NET and Visual Studio, Office, Exchange Server, BitLocker, Remote Desktop Client, NTFS, and the Microsoft Edge browser.
The issue being exploited in the wild is tracked as CVE-2022-26925, and is described as a Windows LSA spoofing vulnerability. According to Microsoft’ssecurity advisory, an authenticated threat actor could abuse the flaw by calling a method on the LSARPC interface and forcing the domain controller to authenticate the attacker using NTLM. It has a severity score of 8.1
Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at theend of this surveyto get the bookazine, worth $10.99/£10.99.
As for the critical issues, there are five remote code execution (RCE) flaws, and two elevation of privilege (EoP) vulnerabilities. Among these is CVE-2022-26923, a critical flaw that exploits how certificates are issued, by injecting data into a certificate request. That way, the threat actor can get a certificate able to authenticate a domain controller with high privileges. In other words, the threat actor can gain admin privileges on any domain running Active Directory Certificate Services. This one has a severity score of 8.8.
Denial of service, spoofing, and more
The cumulative update also fixes 67 exploits, most of which are RCE and EoP flaws, denial of service flaws, spoofing issues, anddefensebypasses.
Given that the update addresses a couple of high-severity flaws, Windows OS admins are urged to patch theirendpointsimmediately.
This is probably going to be one of the last Patch Tuesday cumulative updates, as Microsoft is planning on killing the practice altogether.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Microsoft is ready to kill off Patch Tuesday as we know it>The latest Microsoft Patch Tuesday release fixes over 100 serious bugs>This nasty Windows 10 zero-day vulnerability finally has an unofficial fix
Last month, the company announced that it will strive to update all Windows corporate endpoints automatically, with the new scheme kicking off in July this year.
The updates will be rolled out in three phases, to minimize the chances of bricking all of the devices found in a corporate network at once.
Via:ZDNet
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
HPE reveals critical security bug affecting networking access points
A critical Palo Alto Networks bug is being hit by cyberattacks, so patch now
Another reason to avoid edge-lit 4K TVs: they may fail faster than others, according to this report
