Zero-days flaws imply it is time to patch Exchange and Windows
For this month’s Patch Tuesday, Microsoft handled 84 flaws and a zero-day vulnerability affecting Microsoft Exchange that hasn’t but been absolutely resolved.
Traitov / Getty Images
This month’s Patch Tuesday replace from Microsoft offers with 84 flaws and a zero-day affecting Microsoft Exchange that for the time being stays unresolved. The Windows updates deal with Microsoft safety and networking parts with a difficult-to-test replace to COM and OLE db. And Microsoft browsers get 18 updates—nothing vital or pressing.
That leaves the main target this month on Microsoft Exchange and deploying mitigation efforts, relatively than server updates, for the following week. More details about the dangers of deploying these Patch Tuesday updates can be found on this infographic.
Microsoft continues to enhance each its vulnerability reporting and notifications with a brand new RSS feed, and Adobe has adopted swimsuit with improved reporting and launch documentation. As a delicate reminder, assist for Windows 10 21H1 ends in December.
Key testing eventualities
Given the massive variety of modifications included this month, I’ve damaged down the testing eventualities into high-risk and standard-risk teams:
High Risk: For October, Microsoft has not recorded any high-risk performance modifications. This means it has not made main modifications to core APIs or to the performance to any of the core parts or functions included within the Windows desktop and server ecosystems.
More typically, given the broad nature of this replace (Office and Windows), we advise testing the next Windows options and parts:
- A GDI replace (GDIPLUS.DLL) requires testing of EMF, each 16- and 32-bit palette recordsdata (opening, printing, and creating).
- Microsoft’s Desktop Application Manager has been up to date and would require each provisioning and un-provisioning functions (each set up and uninstall testing is required).
- The Windows CLFS system has been up to date to require a brief take a look at of making, studying, updating, and deleting log recordsdata.
In addition to those modifications and testing necessities, I’ve included a few of the tougher testing eventualities:
- OLE DB: The venerable Microsoft OLE DB has been up to date and requires all functions with a dependency on SQL Server 2012 or ADO.NET must be absolutely examined earlier than deployment. This Microsoft COM part (OLE DB) separates information from software logic by way of a set of connections that entry information supply, session(s), SQL instructions, and row-set information.
- Roaming credentials, cryptography keys, and certificates: To discover out extra about Credential Roaming, take a look at Microsoft’s Jim Tierney’s posting and this nice introduction to Credential Roaming.
- Encrypted VPN Connections: Microsoft up to date the IKEv2 and L2TP/IPsec parts this month. Testing with distant connections ought to last more than eight hours. If you’re having hassle with this replace, Microsoft has printed a L2TP/IPSec VPN Troubleshooting information.
Unless in any other case specified, we must always now assume every Patch Tuesday replace would require testing core printing features, together with:
- printing from straight related printers;
- giant print jobs from servers (particularly if they’re additionally area controllers);
- distant printing (utilizing RDP and VPN).
Known points
Each month, Microsoft features a listing of recognized points that relate to the working system and platforms included on this replace cycle.
- Devices with Windows installations created from customized offline media or a customized ISO picture may need Microsoft Edge Legacy eliminated by this replace, however not routinely changed by the brand new Microsoft Edge. Resolving this concern would require a full/new set up of Microsoft Edge.
- Microsoft SharePoint: This replace would possibly have an effect on some SharePoint 2010 workflow eventualities. It additionally generates “6ksbk” occasion tags in SharePoint Unified Logging System (ULS) logs.
One reported concern with the newest Microsoft Servicing Stack Update (SSU) KB5018410 is that Group Policy preferences might fail. Microsoft is engaged on an answer; within the meantime, the corporate posted the next mitigations:
Major revisions
So far, Microsoft has not printed any main revisions to its safety advisories.
Mitigations and workarounds
There are two mitigations and 4 work-arounds for this October Patch Tuesday, together with:
- CVE-2022-41803: Visual Studio Code Elevation. Microsoft printed a fast work-around for this safety vulnerability that claims: “Create a folder C:ProgramDatajupyterkernels and configure it to be writable solely by the present person.”
- CVE-2022-22041: Windows Print Spooler Elevation. Microsoft’s printed work-around recommendation for managing this vulnerability is to cease the printer spooler service on the goal machine utilizing the next PowerShell instructions, “Stop-Service -Name Spooler -Force, and Set-Service -Name Spooler -StartupType Disabled.” This will cease the native print spooler on the machine and any printing companies utilized by that system.
Microsoft has additionally famous that for the next reported community vulnerabilities, these programs usually are not affected if IPv6 is disabled and might be mitigated with the next PowerShell command: “Get-Service Ikeext:”
- CVE-2022-37976: Windows TCP/IP Driver Denial of Service Vulnerability;
- CVE-2022-34721: Windows Internet Key Exchange (IKE) Protocol Extensions;
- CVE-2022-3471, CVE-2022-33645 and CVE-2022-34718: Windows TCP/IP Remote Code Execution Vulnerability.
Each month, we break down the replace cycle into product households (as outlined by Microsoft) with the next fundamental groupings:
- Browsers (Microsoft IE and Edge);
- Microsoft Windows (each desktop and server);
- Microsoft Office;
- Microsoft Exchange;
- Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core);
- Adobe (retired???, possibly subsequent 12 months).
Browsers
Microsoft launched 18 updates to Edge (Chromium). Only CVE-2022-41035 particularly applies to the browser, whereas the remaining are Chromium associated. You can discover this month’s launch be aware right here. These are low profile, non-critical patches to Microsoft’s newest browser; they are often added to your normal launch schedule.
Windows
Microsoft delivers patches for 10 vital and 57 essential vulnerabilities that cowl the next function teams within the Windows platform:
- Windows Networking (DNS, TLS, distant entry and the TCP/IP stack);
- Cryptography (IKE extensions and Kerberos);
- Printing (once more);
- Microsoft COM and OLE DB;
- Remote Desktop (Connection Manager and APIs).
One COM+ object-related vulnerability (CVE-2022-41033) has been reported as exploited within the wild. This makes issues robust for patch and replace deployment groups. Testing COM objects is usually tough because of the enterprise logic required and contained throughout the software. Also, figuring out which functions rely on this function isn’t easy. This is very the case for in-house developed or line-of-business functions attributable to enterprise criticality. We suggest assessing, isolating, and testing core enterprise apps which have COM and OLE dB dependencies earlier than a basic deployment of the October replace. Add this Windows replace to your “Patch Now” schedule.
On the lighter aspect of issues, Microsoft has launched one other Windows 11 replace video.
Microsoft Office
This month we get two vital updates (CVE-2022-41038 and CVE-2022-38048) and 4 updates rated as essential to the Microsoft Office platform. Unless you’re managing a number of SharePoint servers, it is a comparatively low-profile replace, with no Preview Pane-based assault vectors and no stories of exploits within the wild. If you or your staff skilled points with Microsoft Outlook crashing (sorry, “closing”) final month, Microsoft has provides the next recommendation:
Given these modifications and low-profile updates, we advise that you simply add these Office patches to your normal launch schedule.
Microsoft Exchange Server
We ought to have began with the Microsoft Exchange updates this month. The vital remote-pcode execution vulnerabilities (CVE-2022-41082 and CVE-2022-41040) in Exchange have been reported as exploited within the wild and haven’t been resolved with this safety replace. There are patches out there, and they’re official from Microsoft. However, these two updates to Microsoft Exchange Server don’t absolutely repair the vulnerabilities.
The Microsoft Exchange Team weblog makes this level explicitly in the course of a launch be aware:
“The October 2022 SUs don’t include fixes for the zero-day vulnerabilities reported publicly on September 29, 2022 (CVE-2022-41040 and CVE-2022-41082). Please see this weblog put up to use mitigations for these vulnerabilities. We will launch updates for CVE-2022-41040 and CVE-2022-41082 when they’re prepared.”
Microsoft has printed mitigation recommendation for these critical Exchange safety points, masking:
- CVE-2022-41040: Exchange Emergency Mitigation Service
- CVE-2022-41082: Disable Remote PowerShell for Exchange
We suggest implementing each the URL and PowerShell mitigations for all of your Exchange servers. Watch this house, as we’ll see an replace from Microsoft within the upcoming week.
Microsoft growth platforms
Microsoft has launched 4 updates (all rated essential) for Visual Studio and .NET. Though all 4 vulnerabilities (CVE-2022-41032, CVE-2022-41032, CVE-2022-41034 and CVE-2022-41083) have normal entries within the Microsoft Security Update Guide (MSUG), the Visual Studio staff has additionally printed these 17.3 Release notes. (And, similar to Windows 11, we even get a video.) All 4 of those updates are low-risk, low-profile updates to the event platform. Add these to your normal developer launch schedule.
Adobe (actually simply Reader)
Adobe Reader has been up to date (APSB22-46) to resolve six reminiscence associated vulnerabilities. With this launch, Adobe has additionally up to date launch documentation to incorporate Known Issues and deliberate Release Notes. These notes cowl each Windows and MacOS and each variations of Reader (DC and Continuous). All six reported vulnerabilities have the bottom Adobe ranking, 3, which Adobe helpfully provides the next patch recommendation for: “Adobe recommends directors set up the replace at their discretion.”
We agree — add these Adobe Reader updates to your normal patch deployment schedule.
