April’s Patch Tuesday: numerous massive, numerous and pressing updates
This month’s Patch Tuesday launch was a giant one, and contains fixes for Microsoft browsers and two zero-day vulnerabilities for Windows. Time to get busy updating!
Putilich / Getty Images
This week’s Patch Tuesday launch was big, numerous, dangerous, and pressing, with late replace arrivals for Microsoft browsers (CVE-2022-1364) and two zero-day vulnerabilities affecting Windows (CVE-2022-26809 and CVE-2022-24500). Fortunately, Microsoft has not launched any patches for Microsoft Exchange, however this month we do should cope with extra Adobe (PDF) printing associated vulnerabilities and related testing efforts. We have added the Windows and Adobe updates to our “Patch Now” schedule, and will probably be watching carefully to see what occurs with any additional Microsoft Office updates.
As a reminder, Windows 10 1909/20H2 (Home and Pro) will attain their finish of servicing dates on May 10. And in case you are searching for a simple option to replace your server-based .NET parts, Microsoft now has .NET auto-update updates for servers. You can discover extra info on the danger of deploying these Patch Tuesday updates on this helpful infographic.
Key testing eventualities
Given what we all know thus far, there are three reported high-risk adjustments included on this month’s patch launch, together with:
- Printer replace(s) to the SPOOL part, which can have an effect on web page printing from browsers and graphically dense photographs.
- A community replace to named pipes that will trigger points with Microsoft’s distant desktop providers.
More usually, given the massive quantity and numerous nature of the adjustments for this month’s cycle, we suggest testing the next areas:
- Test your DNS Zone and Server Scope operations if used in your native servers (DNS Manager);
- Test printing PDFs out of your browsers (each desktop and server);
- Test your FAX (Castelle anybody?) and phone (telephony) primarily based functions;
- And set up, restore, and uninstall your core software packages (this in all probability must be automated, with a baseline information for detailed evaluation).
Microsoft has up to date numerous APIs, together with key file and kernel parts (FindNextFile, FindFirstStream and FindNextStream). Given the ubiquity of those widespread API calls, we recommend making a server stress check that employs very heavy native file masses and pay specific consideration to the Windows Installer replace that requires each set up and uninstall testing. Validating software uninstallation routines has fallen out of vogue these days attributable to enhancements with software deployment, however the next must be stored in thoughts when functions are faraway from a system:
- Does the applying uninstall? (Files, registry, shortcuts, providers, and setting settings);
- Does the uninstall course of take away parts from functions or shared assets?
- Are any key assets (system drivers) eliminated, and do different functions have shared dependencies?
I’ve discovered that maintaining software uninstallation Installer logs and evaluating (hopefully the identical) info throughout updates might be the one correct technique — “eyeballing” a cleaned system just isn’t adequate. And lastly, given the adjustments to the kernel on this replace, check (smoke check) your legacy functions. Microsoft has now included deployment and reboot necessities in a single web page.
Known points
Each month, Microsoft features a record of recognized points that relate to the working system and platforms included within the newest replace cycle. There are greater than ordinary this month, so I’ve referenced a number of key points that relate to the most recent builds from Microsoft, together with:
- After putting in the Windows updates launched Jan. 11, 2022 or afterward an affected model of Windows, restoration discs (CD or DVD) created utilizing the Backup and Restore (Windows 7) app within the Control Panel could be unable to begin.
- After putting in this Windows replace, connecting to units in an untrusted area utilizing Remote Desktop may fail to authenticate when utilizing good card authentication. You may obtain the immediate, “Your credentials didn’t work. The credentials that have been used to hook up with [device name] didn’t work. Please enter new credentials,” and “The login try failed” in crimson. This concern is resolved utilizing Known Issue Rollback (KIR) utilizing group coverage set up information: Windows Server 2022, Windows 10, model 2004, Windows 10, model 20H2, Windows 10, model 21H1, and Windows 10, model 21H2.
- After putting in updates launched Jan. 11, 2022 or later, apps that use the Microsoft .NET Framework to accumulate or set Active Directory Forest Trust Information may need points. To resolve this concern manually, apply these Microsoft .NET out-of-band updates.
- Some organizations have reported Bluetooth pairing and connectivity points. If you might be utilizing Windows 10 21H2 or later, Microsoft is conscious of the scenario and is engaged on a decision.
- The Microsoft Exchange Service fails after putting in the March 2022 safety replace. For extra info please consult with:
- KB5012698 – Microsoft Exchange Server 2019 and 2016 (March 8, 2022)
- KB5010324 – Microsoft Exchange Server 2013 (March 8, 2022)
For extra details about recognized points, please go to the Windows Health Release website.
Major revisions
This month, we see two main revisions to updates which were beforehand launched:
- CVE-2022-8927: Brotli Library Buffer Overflow Vulnerability: This patch, launched final month, was raised as a priority on how Internet Explorer would deal with adjustments to compressed information similar to CSS and customized scripts. This newest replace merely expands the variety of merchandise affected, and now contains Visual Studio 2022. No different adjustments have been made, and due to this fact no additional motion is required.
- CVE-2021-43877 | ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability: This is one other “affected product” replace that additionally contains protection for Visual Studio 2022. No additional motion is required.
Mitigations and workarounds
This is a big replace for a Patch Tuesday, so we have now seen a larger-than-expected variety of documented mitigations for Microsoft merchandise and parts, together with:
- CVE-2022-26919: Windows LDAP Remote Code Execution Vulnerability — Microsoft has supplied the next mitigation: “For this vulnerability to be exploitable, an administrator should improve the default MaxReceiveBuffer LDAP setting.”
- CVE-2022-26815: Windows DNS Server Remote Code Execution Vulnerability. This concern is just relevant when dynamic DNS updates are enabled.
And for the next reported vulnerabilities, Microsoft recommends “blocking port 445 on the perimeter firewall.”
- CVE-2022-26809: Remote Procedure Call Runtime Remote Code Execution Vulnerability.
- CVE-2022-26830: DiskUsage.exe Remote Code Execution Vulnerability
- CVE-2022-24541: Windows Server Service Remote Code Execution Vulnerability
- CVE-2022-24534: Win32 Stream Enumeration Remote Code Execution Vulnerability
You can learn extra right here about securing these vulnerabilities and your SMB networks.
Each month, we break down the replace cycle into product households (as outlined by Microsoft) with the next primary groupings:
- Browsers (Microsoft IE and Edge)
- Microsoft Windows (each desktop and server)
- Microsoft Office
- Microsoft Exchange
- Microsoft Development platforms (ASP.NET Core, .NET Core and Chakra Core)
- Adobe (retired???, perhaps subsequent yr)
Browsers
There have been no vital updates to any of Microsoft’s browsers. There have been 17 updates to the Chromium mission’s Edge browser, which, given how they have been applied, ought to have marginal to no impact on enterprise deployments. All these updates have been launched final week as a part of the Chromium replace cycle. However, it seems to be like we are going to see one other set of vital/emergency Chrome updates with studies of CVE-2022-1364 exploited within the wild. This would be the third set of emergency updates this yr.
If your IT workforce is seeing massive numbers of surprising browser crashes, you could be weak to this very critical kind confusion concern within the V8 JavaScript engine. Microsoft has not launched any updates this month for its different browsers. So, now is an efficient time to make sure your emergency change administration practices are in place to help massive, very fast adjustments to key desktop parts (similar to browser updates).
Windows
This Patch Tuesday delivered numerous updates to the Windows platform. With over 117 reported fixes (now 119) overlaying key parts of each desktop and server platforms together with:
- Hyper-V
- Windows Networking (SMB).
- Windows Installer.
- Windows Common Log (once more).
- Remote Desktop (once more, and once more).
- Windows Printing (oh no, not once more).
With all of those assorted patches, this replace carries a various testing profile and, sadly with the current studies of CVE-2022-26809 and CVE-2022-24500 exploited within the wild, a way of urgency. In addition to those two worm-able, zero-day exploits, Microsoft has really useful fast mitigations (blocking community ports) towards 5 reported vulnerabilities. We have additionally been suggested that for many massive organizations, testing Windows installer (set up, restore and uninstall) is really useful for core functions, additional growing among the technical effort required earlier than normal deployment of those patches. And, sure, printing goes to be a difficulty. We recommend a concentrate on printing massive PDF information over distant (VPN) connections as a superb begin to your testing regime.
Add this massive Windows replace to your “Patch Now” launch schedule.
Microsoft Office
Though Microsoft has launched 5 updates for the Office platform (all rated as vital), that is actually a “let’s replace Excel launch” with CVE-2022-24473 and CVE-2022-26901 addressing potential arbitrary code execution (ACE) points. These are two critical safety points that when paired with an elevation-of-privilege vulnerability results in a “click-to-own” state of affairs. We totally anticipate that this vulnerability will probably be reported as exploited within the wild within the subsequent few days. Add these Microsoft Office updates to your customary patch launch schedule.
Microsoft Exchange Server
Fortunately for us, Microsoft has not launched any replace for Exchange Server this month. That mentioned, the return of Adobe PDF points ought to hold us busy.
Microsoft growth platforms
For this cycle, Microsoft launched six updates (all rated as vital) to its growth platform affecting Visual Studio, GitHub, and the .NET Framework. Both the Visual Studio (CVE-2022-24513 and CVE-2022-26921) and the GitHub (CVE-2022-24765, CVE-2022-24767) vulnerabilities are application-specific and must be deployed as application-specific updates. However, the .NET patch (CVE-2022-26832) impacts all at present supported .NET variations and can possible be bundled with the most recent Microsoft .NET high quality updates (learn extra about these updates right here). We suggest deploying the .NET April 22 high quality updates with this month’s patches to scale back your testing time and deployment effort.
Adobe (actually simply Reader)
Well, nicely, nicely…, what do we have now right here? Adobe Reader is again this month with PDF printing inflicting extra complications for Windows customers. For this month, Adobe has launched APSB22-16, which addresses over 62 vital vulnerabilities in how each Adobe Reader and Acrobat deal with reminiscence points (see Use after Free) when producing PDF information. Almost all of those reported safety points may result in distant code execution on the goal system. Additionally, these PDF associated points are linked to a number of Windows (each desktop and server) printing points addressed this month by Microsoft.
Add this replace to your “Patch Now” launch schedule.