Microsoft’s Patch Tuesday bundle for this month is a big one: 74 documented vulnerabilities in multiple Windows products and components, some serious enough to lead to remote code execution attacks.
The Redmond, Wash.-based software giant cautioned that exploit code is publicly available for three of the patched vulnerabilities — remote code execution bugs in Remote Desktop Client and .NET and Visual Studio, and a privilege escalation flaw in the Windows Fax and Scan service.
“In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the RDP client machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client,” Microsoft explained in an ‘important’ advisory.
The March patch batch contains fixes for three issues rated “critical,” Microsoft’s highest severity rating. These include remote code execution vulnerabilities in Microsoft Exchange Server and the HEVC and VP0 video extensions.
Microsoft said it had no evidence that any of the vulnerabilities were exploited in the wild as zero-day.
[ PREVIOUSLY: Patch Tuesday: Windows Flaw Under Active Attack ]
Vulnerability trackers at the Zero Day Initiative are calling special attention to the Microsoft Exchange server flaw — CVE-2022-23277 — as one that needs to be tested and deployed with urgency.
“The [Exchange Server] vulnerability would allow an authenticated attacker to execute their code with elevated privileges through a network call. This is also listed as low complexity with exploitation more likely, so it would not surprise me to see this bug exploited in the wild soon – despite the authentication requirement. Test and deploy this to your Exchange servers quickly,” ZDI urged in a blog post.
The Microsoft patches also cover numerous code execution, denial-of-service and elevation of privilege issues in Azure Site Recovery and additional bugs in Microsoft Defender, Microsoft Office, and Windows Event Tracing.
Microsoft’s patches were released hours after software maker Adobe rolled out urgent security updates to address code execution vulnerabilities in Illustrator and After Effects products.
The Adobe patches cover arbitrary code execution and memory leak vulnerabilities that could expose data to malicious hacker attacks.
[ READ: Microsoft Calls Attention to ‘Wormable’ Windows Security Flaw ]
The most serious of the vulnerabilities was addressed in Adobe Illustrator, the popular vector graphics design program available for both macOS and Windows systems.
In an advisory, Adobe rated the Illustrator flaw as “critical” with a CVSS base score of 7.8. The company described the CVE-2022-23187 bug as a buffer overflow affecting Illustrator 2022 version 26.0.3 (and earlier versions) on both WIndows and macOS machines.
Adobe is strongly urging users to upgrade to Illustrator 2022 version 26.1.0.
The San Jose, Calif.-based Adobe also issued a separate alert to warn of at least four critical flaws haunting users of After Effects, another popular software product used in motion graphics creative projects.
The quartet of bugs are all described as stack-based buffer overflows that could allow computer takeover attacks.
Related: Microsoft Patch Tuesday: Windows Flaw Under Active Attack
Related: Microsoft Office Zero-Day Hit in Targeted Attacks
Related: Adobe Joins Security Patch Tuesday Frenzy
Related: Adobe Warns of Critical Flaws in Magento, Connect
Related: Did Microsoft Botch the PrintNightmare Patch?
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Ryan is a director of the Security Tinkerers non-profit, and a regular speaker at security conferences around the world.
Follow Ryan on Twitter @ryanaraine.
Tags:
