Microsoft’s Patch Tuesday bundle for this month is a big one: 74 documented vulnerabilities in multiple Windows products and components, some serious enough to lead to remote code execution attacks.
The Redmond, Wash.-based software giant cautioned that exploit code is publicly available for three of the patched vulnerabilities — remote code execution bugs in Remote Desktop Client and .NET and Visual Studio, and a privilege escalation flaw in the Windows Fax and Scan service.
“In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the RDP client machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client,” Microsoft explained in an ‘important’ advisory.
The March patch batch contains fixes for three issues rated “critical,” Microsoft’s highest severity rating. These include remote code execution vulnerabilities in Microsoft Exchange Server and the HEVC and VP0 video extensions.
Microsoft said it had no evidence that any of the vulnerabilities were exploited in the wild as zero-day.
[ PREVIOUSLY: Patch Tuesday: Windows Flaw Under Active Attack ]
Vulnerability trackers at the Zero Day Initiative are calling special attention to the Microsoft Exchange server flaw — CVE-2022-23277 — as one that needs to be tested and deployed with urgency.
“The [Exchange Server] vulnerability would allow an authenticated attacker to execute their code with elevated privileges through a network call. This is also listed as low complexity with exploitation more likely, so it would not surprise me to see this bug exploited in the wild soon – despite the authentication requirement. Test and deploy this to your Exchange servers quickly,” ZDI urged in a blog post.
The Microsoft patches also cover numerous code execution, denial-of-service and elevation of privilege issues in Azure Site Recovery and additional bugs in Microsoft Defender, Microsoft Office, and Windows Event Tracing.
Microsoft’s patches were released hours after software maker Adobe rolled out urgent security updates to address code execution vulnerabilities in Illustrator and After Effects products.
The Adobe patches cover arbitrary code execution and memory leak vulnerabilities that could expose data to malicious hacker attacks.
[ READ: Microsoft Calls Attention to ‘Wormable’ Windows Security Flaw ]
The most serious of the vulnerabilities was addressed in Adobe Illustrator, the popular vector graphics design program available for both macOS and Windows systems.
In an advisory, Adobe rated the Illustrator flaw as “critical” with a CVSS base score of 7.8. The company described the CVE-2022-23187 bug as a buffer overflow affecting Illustrator 2022 version 26.0.3 (and earlier versions) on both WIndows and macOS machines.
Adobe is strongly urging users to upgrade to Illustrator 2022 version 26.1.0.
The San Jose, Calif.-based Adobe also issued a separate alert to warn of at least four critical flaws haunting users of After Effects, another popular software product used in motion graphics creative projects.
The quartet of bugs are all described as stack-based buffer overflows that could allow computer takeover attacks.
Related: Microsoft Patch Tuesday: Windows Flaw Under Active Attack
Related: Microsoft Office Zero-Day Hit in Targeted Attacks
Related: Adobe Joins Security Patch Tuesday Frenzy
Related: Adobe Warns of Critical Flaws in Magento, Connect
Related: Did Microsoft Botch the PrintNightmare Patch?
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Microsoft Catches Chinese .Gov Hackers Targeting US Critical Infrastructure
- Researchers Spot APTs Targeting Small Business MSPs
- Mikrotik Belatedly Patches RouterOS Flaw Exploited at Pwn2Own
- Red Hat Pushes New Tools to Secure Software Supply Chain
- Investors Make $6M Bet on Manifest for SBOM Management Technology
- Entro Raises $6M to Tackle Secrets Sprawl
- IBM Snaps up DSPM Startup Polar Security
- Huntress Closes $60M Series C for MDR Expansion
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
