Rewterz Threat Advisory – Multiple Microsoft Vulnerabilities – Patch Tuesday

Severity

High

Analysis Summary

CVE-2022-23252

Microsoft Office could allow a local authenticated attacker to obtain sensitive information,. By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

CVE-2022-23255

Microsoft OneDrive for Android could allow a local authenticated attacker to bypass security restrictions. An attacker could exploit this vulnerability to bypass security feature to cause impact on confidentiality.

CVE-2022-23256

Microsoft Azure Data Explorer could allow a remote attacker to conduct spoofing attacks.

CVE-2022-22709

Microsoft VP9 Video Extensions could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-23269

Microsoft Dynamics GP could allow a remote authenticated attacker to conduct spoofing attacks.

CVE-2022-23271

Microsoft Dynamics GP could allow a remote authenticated attacker to gain elevated privileges on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-23272

Microsoft Dynamics GP could allow a remote authenticated attacker to gain elevated privileges on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-23273

Microsoft Dynamics GP could allow a remote authenticated attacker to gain elevated privileges on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-23274

Microsoft Dynamics GP could allow a remote authenticated attacker to execute arbitrary code on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-23276

Microsoft SQL Server for Linux Containers could allow a local authenticated attacker to gain elevated privileges on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-23280

Microsoft Outlook for Mac could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability to bypass security feature to cause impact on confidentiality.

CVE-2022-22716

Microsoft Excel could allow a local authenticated attacker to obtain sensitive information,. By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

CVE-2022-22717

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Print Spooler component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-22718

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Print Spooler component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-21984

Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the DNS Server component. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-21985

Microsoft Windows could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the Remote Access Connection Manager component. By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

CVE-2022-21986

Microsoft .Net is vulnerable to a denial of service, caused by a flaw in the Kestrel Web Server. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.

CVE-2022-21989

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Kernel component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-21991

Microsoft Visual Studio Code could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Remote Development Extension component. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-21992

Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Mobile Device Management component. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-21993

Microsoft Windows could allow a remote attacker to obtain sensitive information, caused by a flaw in the Services for NFS ONCRPC XDR Driver. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

CVE-2022-21994

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the DWM Core Library component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-21995

Microsoft Windows Hyper-V could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-21996

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-21997

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Print Spooler component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-21998

Microsoft Windows could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the Common Log File System Driver. By executing a specially-crafted program, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.

CVE-2022-21999

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Print Spooler component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-22000

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Common Log File System Driver component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-22001

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Remote Access Connection Manager component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-22002

Microsoft Windows is vulnerable to a denial of service, caused by a flaw in the User Account Profile Picture component. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.

CVE-2022-22003

Microsoft Office could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Graphics component. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-22004

Microsoft Office ClickToRun could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-22005

Microsoft SharePoint Server could allow a remote authenticated attacker to execute arbitrary code on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Impact

• Denial of Service
• Information Disclosure
• Security Bypass
• Code Execution
• Unauthorized Access
• Privilege Escalation

Indicators of Compromise

CVE

• CVE-2022-23252
• CVE-2022-23255
• CVE-2022-23256
• CVE-2022-22709
• CVE-2022-23269
• CVE-2022-23271
• CVE-2022-23272
• CVE-2022-23273
• CVE-2022-23274
• CVE-2022-23276
• CVE-2022-23280
• CVE-2022-22716
• CVE-2022-22717
• CVE-2022-22718
• CVE-2022-21984
• CVE-2022-21985
• CVE-2022-21986
• CVE-2022-21989
• CVE-2022-21991
• CVE-2022-21992
• CVE-2022-21993
• CVE-2022-21994
• CVE-2022-21995
• CVE-2022-21996
• CVE-2022-21997
• CVE-2022-21998
• CVE-2022-21999
• CVE-2022-22000
• CVE-2022-22001
• CVE-2022-22002
• CVE-2022-22003
• CVE-2022-22004
• CVE-2022-22005

Affected Vendors

Microsoft

Affected Products

• Microsoft Office 2013 SP1 x32
• Microsoft Office 2013 SP1 x64
• Microsoft Office 2013 SP1 RT
• Microsoft Office 2016 x32
• Microsoft Office 2016 x64
• Microsoft Office 2019 x32
• Microsoft Office 2019 x64
• Microsoft 365 Apps for Enterprise x32
• Microsoft 365 Apps for Enterprise x64
• Microsoft Office LTSC 2021 x32
• Microsoft Office LTSC 2021 x64
• Microsoft OneDrive for Android
• Microsoft Azure Data Explorer
• Microsoft VP9 Video Extensions
• Microsoft Dynamics GP
• Microsoft SQL Server 2019 for Linux Containers
• Microsoft Excel 2013 SP1 x32
• Microsoft Excel 2013 SP1 x64
• Microsoft Excel 2013 SP1 RT
• Microsoft Excel 2016 x32
• Microsoft Windows 7 SP1 x32
• Microsoft Windows 7 SP1 x64
• Microsoft Windows Server 2012
• Microsoft Windows 8.1 x32
• Microsoft Windows 10 1909 for 32-bit Systems
• Microsoft Windows 10 1909 for x64-based Systems
• Microsoft Windows 10 1909 for ARM64-based Systems
• Microsoft Windows 10 20H2 for 32-bit Systems
• Microsoft Visual Studio 2019 16.0
• Microsoft Visual Studio 2019 16.1
• CONFIDENTIAL 7
• Microsoft Visual Studio 2019 16.2
• Microsoft Visual Studio 2019 16.4
• Microsoft Visual Studio Code
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows 10 1809 for x64-based Systems
• Microsoft Windows 10 1809 for 32-bit Systems
• Microsoft Windows 8.1 x64
• Microsoft Windows Server 2012 R2
• Microsoft Windows 10 1809 for ARM64-based Systems
• Microsoft Windows 10 x64
• Microsoft Windows 11 x64
• Microsoft Windows 11 ARM64
• Microsoft Office 2013 Click-to-Run (C2R) for 32-bit editions
• Microsoft Office 2013 Click-to-Run (C2R) for 64-bit editions
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Enterprise Server 2013 SP1
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

Remediation

Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to
search for available patches.
CVE-2022-23252
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23252
CVE-2022-23255
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23255
CVE-2022-23256
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23256
CVE-2022-22709
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22709
CVE-2022-23269
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23269
CVE-2022-23271
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23271
CVE-2022-23272
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23272
CVE-2022-23273
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23273
CVE-2022-23274
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23274
CVE-2022-23276
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23276
CVE-2022-23280
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-23276
CVE-2022-22716
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22716
CVE-2022-22717
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22717
CVE-2022-22718
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22718
CVE-2022-21984
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21984
CVE-2022-21985
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21985
CVE-2022-21986
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21986
CVE-2022-21989
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21989
CVE-2022-21991
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21991
CVE-2022-21992
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21992
CVE-2022-21993
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21993
CVE-2022-21994
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21994
CVE-2022-21995
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21995
CVE-2022-21996
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21996
CVE-2022-21997
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21997
CVE-2022-21998
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21998
CVE-2022-21999
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-21999
CVE-2022-22000
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22000
CVE-2022-22001
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22001
CVE-2022-22002
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22002
CVE-2022-22003
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22003
CVE-2022-22004
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22004
CVE-2022-22005
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2022-22005