It is time for another Patch Tuesday, and while we are looking at a lower number of exploits patched overall, some of them are absolute doozies. Overall, we are looking at 73 total exploits, six critical, two publicly disclosed, and one actively exploited. That is quite the combo. I am feeling optimistic today, so while breaking down the horror, I will try and give a bright side for each!
Some highlights (or lowlights)
CVE-2022-26925: This is the one that is actively exploited. It allows an attacker to spoof LSA(Local Security Authority) to force the domain controller to authenticate. It is rated as an 8.1 but can be paired with a separate exploit that would set the score to a 9.8. It has a Network attack vector with no privileges or user interaction required. All servers will need to be patched, not just Domain Controllers. You will want to make sure every server has this and KB5005413 applied to ensure you are completely secure.
Positive: …the complexity is listed as high?
CVE-2022-26937: This critical RCE patch attacking the Network File system is rated as a 9.8. The attack vector is Network, no privileges or user interaction is required, and complexity is low. That has all the markers of something that is wormable. This is a bad one that impacts a commonly used component as well. This exploit does not impact the latest versions of NFS, so you are safe if you are not on 2 or 3. If you are using 2 or 3 and cannot upgrade to 4.1 without impacting your production, you can do that with some quick PowerShell.
C:\Set-NfsServerConfiguration -EnableNFSV2 $false -EnableNFSV3 $falsePositive: This exploit does not work on NFSV4.1
CVE-2022-29130: This LDAP RCE exploit is also rated as a 9.8. It has many of the same markers as the previous patch we listed but with one major mitigating factor. You are not at risk if you have not increased your MaxRecieveBuffer higher than the default. You will need to check your DCs, but if your mac buffer is over 10,485,760 bytes, you might want to decrease it until you can get patched.
Positive: You are already protected if you never messed with a random LDAP setting!
Wrapping up
OOF! This was a rough month for optimism. A lot of those exploits are really bad. We did not even go into the exploits that are already known. The sooner you can get your lab patched for testing, the better. With the right tools, your lab could already be patching for you while you read this blog and ponder how we got to this point. Automating your peace of mind seems like a great and thematically aligned way to end this blog. Happy patching!
Loading...
