Microsoft patches two zero-day vulnerabilities in last Patch Tuesday of 2022

Microsoft has issued fixes for two zero-day vulnerabilities in its final Patch Tuesday of the year.

In its latest bulletin, Microsoft said it will roll out security updates for a number of operating system components and software products, including Azure, Microsoft Dynamics, Windows Kernel, and SmartScreen.

The update batch includes 49 patched vulnerabilities, six of which are rated critical, and one that researchers identified as having been actively exploited.

This potentially exploited bug, tracked as CVE-2022-44698, affects Windows SmartScreen and would enable threat actors to bypass Mark of the Web (MOTW) protocols.

“An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging,” Microsoft revealed in its security update.

Microsoft clarified that this particular flaw could be exploited in web-based attack scenarios whereby an attacker hosts a malicious website designed specifically to evade security protocols.

Similarly, attackers could leverage email or instant messaging to compromise users by sending a specially crafted .url file.

Microsoft also disclosed a second critical vulnerability, CVE-2022-44710, affecting the DirectX graphics kernel on Windows 11 22H2 systems. This was identified as an elevation of privilege vulnerability that, if successfully exploited, could enable an attacker to gain system privileges.

While recent observation reveals this has not been actively exploited, Microsoft gave the flaw a CVSS rating of 7.8, meaning it is high on the severity scale.

Critical Vulnerabilities

Microsoft has issued patches for all six critical flaws identified in its latest bulletin, which include:

CVE-2022-41127 (Microsoft Dynamics)

CVE-2022-44670 (Windows Secure Socket Tunneling Protocol)

CVE-2022-44676 (Windows Secure Socket Tunneling Protocol)

CVE-2022-41076 (PowerShell)

CVE-2022-44690 (SharePoint)

CVE-2022-44693 (SharePoint)

Greg Wiseman, lead product manager at Rapid7, told IT Pro that administrators for SharePoint and Microsoft Dynamics “should be aware of Critical Remote Code Execution (RCE) vulnerabilities” and implement patches immediately.

Patch Tuesday

Microsoft’s final Patch Tuesday of 2022 appears to have been a relatively light month in comparison to November.

Last month saw fixes for six exploited zero-day vulnerabilities and the disclosure of 68 flaws, 11 of which were classified as critical and allowed privilege elevation and remote code execution.

However, Mark Lamb, CEO of HighGround.io, warned that organisations should remain vigilant and prioritise patches to mitigate potential risks.

“It’s the last Patch Tuesday of 2022, and while not as major as last month’s update, we are still finishing the year off with a bang,” he said.

“Two zero-days and six critical flaws, which provide criminals with remote code execution, privileged access and denial of service, among other things. This means a major update and organisations must apply patches as soon as possible,” Lamb added.