Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Microsoft’s August 2022 Patch Tuesday Addresses 118 CVEs (CVE-2022-34713)

Microsoft’s August 2022 Patch Tuesday Addresses 118 CVEs (CVE-2022-34713)

Microsoft addresses 118 CVEs in its August 2022 Patch Tuesday release, including 17 critical flaws.

  1. 17Critical
  2. 101Important
  3. 0Moderate
  4. 0Low

Microsoft patched 118 CVEs in its August 2022 Patch Tuesday release, with 17 rated as critical and 101 rated as important.

This month’s update includes patches for:

  • .NET Core
  • Active Directory Domain Services
  • Azure Batch Node Agent
  • Azure Real Time Operating System
  • Azure Site Recovery
  • Azure Sphere
  • Microsoft ATA Port Driver
  • Microsoft Bluetooth Driver
  • Microsoft Edge (Chromium-based)
  • Microsoft Exchange Server
  • Microsoft Office
  • Microsoft Office Excel
  • Microsoft Office Outlook
  • Microsoft Windows Support Diagnostic Tool (MSDT)
  • Remote Access Service Point-to-Point Tunneling Protocol
  • Role: Windows Fax Service
  • Role: Windows Hyper-V
  • System Center Operations Manager
  • Visual Studio
  • Windows Bluetooth Service
  • Windows Canonical Display Driver
  • Windows Cloud Files Mini Filter Driver
  • Windows Defender Credential Guard
  • Windows Digital Media
  • Windows Error Reporting
  • Windows Hello
  • Windows Internet Information Services
  • Windows Kerberos
  • Windows Kernel
  • Windows Local Security Authority (LSA)
  • Windows Network File System
  • Windows Partition Management Driver
  • Windows Point-to-Point Tunneling Protocol
  • Windows Print Spooler Components
  • Windows Secure Boot
  • Windows Secure Socket Tunneling Protocol (SSTP)
  • Windows Storage Spaces Direct
  • Windows Unified Write Filter
  • Windows WebBrowser Control
  • Windows Win32K

Elevation of privilege (EoP) vulnerabilities accounted for 54.2% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 26.3%.

As part of this month’s Patch Tuesday release, Microsoft addressed three security bypass vulnerabilities in a third-party driver affecting Windows Secure Boot: CVE-2022-34301, CVE-2022-34302 and CVE-2022-34303. These flaws were reported through the CERT Coordination Center (CERT/CC). We have not included these flaws as part of our metrics for this month’s Patch Tuesday release because they are standalone security updates for third-party drivers.

Important

CVE-2022-34713, CVE-2022-35743 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerabilities

CVE-2022-34713 and CVE-2022-35743 are RCE vulnerabilities in the Microsoft Windows Support Diagnostic Tool (MSDT) for troubleshooting. Both CVEs received a CVSS score of 7.8 and are rated important.

CVE-2022-34713 is credited to security researcher Imre Rad, who first disclosed the flaw in January 2020. At the time, Microsoft chose not to patch the flaw. However, following renewed interest in MSDT spurred by the discovery and exploitation of CVE-2022-30190 (aka Follina), Microsoft patched the flaw this month.

Security researcher j00sean resurfaced Rad’s “related” flaw in MSDT that was dubbed DogWalk, though Microsoft says CVE-2022-34713 is a “variant of” DogWalk that has been exploited in the wild.

A variety of attackers have incorporated Follina into their campaigns according to researchers at Proofpoint, Symantec and Cyberint, so we strongly advise organizations apply the available patches for these similar vulnerabilities as soon as possible.

Critical

CVE-2022-21980, CVE-2022-24516, CVE-2022-24477 | Microsoft Exchange Server Elevation of Privilege Vulnerabilities

CVE-2022-21980, CVE-2022-24516 andCVE-2022-24477 are EoP vulnerabilities in Microsoft Exchange Server. Microsoft has published a companion blog post for this Exchange Server update. All three received a CVSSv3 score of 8.0 and were rated “Exploitation More Likely” according to Microsoft’s Exploitability Index. Tianze Ding with Tencent Xuanwu Lab is credited with discovering these vulnerabilities. Yuhao Weng with Sangfor Zhiniang Peng with Sangfor also share credit for CVE-2022-21980.

All three vulnerabilities require authentication and user interaction to exploit — an attacker would need to entice a target to visit a specially crafted Exchange server, likely through phishing. Microsoft also notes that Extended Protection needs to be enabled to fully mitigate these vulnerabilities.

Important

CVE-2022-35755, CVE-2022-35793 | Windows Print Spooler Elevation of Privilege Vulnerabilities

CVE-2022-35755 andCVE-2022-35793are EoP vulnerabilities in Windows Print Spooler Components that both received a CVSSv3 score of 7.3 and were rated “Exploitation More Likely.” These vulnerabilities were discovered by Xuefeng Li with Sangfor who has a long history of disclosing Print Spooler flaws, tracing back to the original PrintNightmare (CVE-2021-34527). CVE-2022-35755 can be exploited using a specially crafted “input file,” while exploitation of CVE-2022-35793 requires a user click on a specially crafted URL. Both would give the attacker SYSTEM privileges.

Both vulnerabilities can be mitigated by disabling the Print Spooler service, but CVE-2022-35793 can also be mitigated by disabling inbound remote printing via Group Policy.

Critical

CVE-2022-35804 | SMB Client and Server Remote Code Execution Vulnerability

CVE-2022-35804 is a RCE vulnerability affecting both the Server Message Block (SMB) client and server on Windows 11 systems using Microsoft SMB 3.1.1 (SMBv3). Microsoft rated this as “Exploitation More Likely” and assigned an 8.8 CVSSV3 score. This vulnerability is reminiscent of past SMB vulnerabilities such as the EternalBlue SMBv1 flaw patched in MS17-010 in March of 2017 that was exploited as part of the WannaCry incident in addition to the more recent CVE-2020-0796 “EternalDarkness” RCE flaw in SMB 3.1.1.

In March of 2022, Microsoft patched CVE-2022-24508, another similar RCE vulnerability impacting SMBv3. Fortunately that flaw has not seen exploitation in the wild, however any flaws impacting SMB always raise concerns of another WannaCry scenario. We strongly recommend patching this vulnerability as soon as possible. Microsoft does provide workaround guidance for organizations that are not able to immediately patch.

Critical

CVE-2022-34691 | Active Directory Domain Services Elevation of Privilege Vulnerability

CVE-2022-34691 is an EoP vulnerability affecting Active Directory Domain Services. With an 8.8 CVSSv3 score, this vulnerability could be exploited by an authenticated attacker to manipulate attributes of accounts and possibly acquire a certificate from Active Directory Certificate Services. This certificate would allow the attacker to elevate their privileges. The advisory notes that exploitation is only possible when Active Directory Certificate Services is running on the domain.

Important

31 Elevation of Privilege Vulnerabilities in Azure Site Recovery

Azure Site Recovery, a suite of tools used for disaster recovery, had a significant number of CVE’s patched in this month's release, including 31 EoP vulnerabilities. CVSS scores range from 4.4 to 8.1 and all of the flaws were rated as Important and “Exploitation Less Likely.” A table of the vulnerabilities can be found below:

CVE Description CVSSv3
CVE-2022-35802 Azure Site Recovery Elevation of Privilege Vulnerability 8.1
CVE-2022-35817 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35816 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35815 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35789 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35814 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35790 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35791 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35813 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35786 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35785 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35811 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35810 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35784 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35788 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35818 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35782 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35799 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35781 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35780 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35775 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35819 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35809 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35801 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35807 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35808 Azure Site Recovery Elevation of Privilege Vulnerability 6.5
CVE-2022-35787 Azure Site Recovery Elevation of Privilege Vulnerability 4.9
CVE-2022-35774 Azure Site Recovery Elevation of Privilege Vulnerability 4.9
CVE-2022-35800 Azure Site Recovery Elevation of Privilege Vulnerability 4.9
CVE-2022-35812 Azure Site Recovery Elevation of Privilege Vulnerability 4.4
CVE-2022-35783 Azure Site Recovery Elevation of Privilege Vulnerability 4.4

In our coverage of July’s Patch Tuesday release, we highlighted another EoP vulnerability discovered by Tenable Researcher Jimi Sebree alongside highlights of multiple additional vulnerabilities patched in the platform. With this month’s release, it’s clear that researchers continue to analyze cloud resources, helping to secure these services before attackers can capitalize on flaws in these highly valuable targets.

Windows Server 20H2 End Of Support

With the August Patch Tuesday release, Windows Server, version 20H2 has now reached its end of service and will no longer receive security updates. A Tenable plugin to identify systems using this version of Windows server will be released soon and we will update this post with the plugin ID once it is available.

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains August 2022.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s August 2022 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web Application Scanning trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.cs Cloud Security.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try Tenable Lumin

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable.io Vulnerability Management, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable.cs

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now.

Your Tenable.cs Cloud Security trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.io Web Application Scanning.

Contact a Sales Rep to Buy Tenable.cs

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Promotional pricing extended until December 31st.
Buy a multi-year license and save more.

Add Support and Training