Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)

Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)

Microsoft addresses 62 CVEs in its September 2022 Patch Tuesday release, including five critical flaws.

  1. 5Critical
  2. 57Important
  3. 0Moderate
  4. 0Low

Microsoft patched 62 CVEs in its September 2022 Patch Tuesday release, with five rated as critical and 57 rated as important. This count omits CVE-2022-23960, a cache speculation restriction vulnerability as it was issued by MITRE and applies to Arm CPUs.

This month’s update includes patches for:

  • .NET and Visual Studio
  • .NET Framework
  • Azure
  • Azure Arc
  • Cache Speculation
  • HTTP.sys
  • Microsoft Dynamics
  • Microsoft Edge (Chromium-based)
  • Microsoft Graphics Component
  • Microsoft Office
  • Microsoft Office SharePoint
  • Microsoft Office Visio
  • Microsoft Windows ALPC
  • Microsoft Windows Codecs Library
  • Network Device Enrollment Service (NDES)
  • Role: DNS Server
  • Role: Windows Fax Service
  • SPNEGO Extended Negotiation
  • Visual Studio Code
  • Windows Common Log File System Driver
  • Windows Credential Roaming Service
  • Windows Defender
  • Windows Distributed File System (DFS)
  • Windows DPAPI (Data Protection Application Programming Interface)
  • Windows Enterprise App Management
  • Windows Event Tracing
  • Windows Group Policy
  • Windows IKE Extension
  • Windows Kerberos
  • Windows Kernel
  • Windows LDAP - Lightweight Directory Access Protocol
  • Windows ODBC Driver
  • Windows OLE
  • Windows Photo Import API
  • Windows Print Spooler Components
  • Windows Remote Access Connection Manager
  • Windows Remote Procedure Call
  • Windows TCP/IP
  • Windows Transport Security Layer (TLS)

Remote code execution (RCE) vulnerabilities accounted for 48.4% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 29%.

Important

CVE-2022-37969 | Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2022-37969 is an EoP vulnerability in the Windows Common Log File System (CLFS) Driver. According to Microsoft, this vulnerability has been exploited in the wild. They also note that it has been publicly disclosed prior to a patch being available.

This is a post-exploitation vulnerability, meaning it can be exploited after an attacker has gained access to a vulnerable target system via other means, including exploiting a separate vulnerability or through social engineering. They could do so using a malicious executable containing exploit code.

CVE-2022-24521, a similar vulnerability in CLFS, was patched earlier this year as part of Microsoft’s April Patch Tuesday release. CVE-2022-24521 flaw was disclosed to Microsoft by the National Security Agency (NSA) and CrowdStrike, which was also exploited in the wild. CVE-2022-37969 has been credited to several groups, including CrowdStrike, though it is unclear at this time if CVE-2022-37969 is potentially a patch-bypass for CVE-2022-24521.

Critical

CVE-2022-34718 | Windows TCP/IP Remote Code Execution Vulnerability

CVE-2022-34718 is a RCE in Windows TCP/IP that received a CVSSv3 score of 9.8 and was rated Exploitation More Likely according to Microsoft’s Exploitability Index. This vulnerability can only be exploited against systems with Internet Protocol Security (IPsec) enabled. Successful exploitation could grant an unauthenticated attacker remote code execution. Microsoft has released patches for all supported versions of Windows, including Server Core editions.

Critical

CVE-2022-34721 and CVE-2022-34722 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

CVE-2022-34721 and CVE-2022-34722 are RCE vulnerabilities in the Windows IKE protocol extensions that received a CVSSv3 score of 9.8 and were rated Exploitation Less Likely. The IKE protocol is a component of IPsec used to set up security associations (relationships among devices based on shared security attributes). These vulnerabilities would allow an unauthenticated, remote attacker to send a specially crafted IP packet to a target with IPsec enabled and achieve remote code execution. IPsec is used to protect sensitive data and is commonly used in virtual private networks. Yuki Chen with Cyber KunLun is credited with disclosing both of these flaws along with CVE-2022-34720, a denial of service flaw in the IKE Protocol Exchange, and CVE-2022-35830, a RCE vulnerability in the Remote Procedure Call runtime.

Important

CVE-2022-37956, CVE-2022-37957 and CVE-2022-37964 | Windows Kernel Elevation of Privilege Vulnerability

CVE-2022-37956, CVE-2022-37957 and CVE-2022-37964 are EoP vulnerabilities impacting the Windows Kernel. All three vulnerabilities received CVSSv3 scores of 7.8 and if exploited, could allow an attacker to gain SYSTEM level privileges. Of the three, only CVE-2022-37957 was rated as “Exploitation More Likely.” Curiously, all three impact various versions of Windows. For instance CVE-2022-37964 only affects Windows 7, Windows Server 2008 and 2008 R2. CVE-2022-37956 affects all supported versions of Windows and Windows server, while CVE-2022-37957 only affects Windows 10 and above, including Windows Server versions 2016, 2019 and 2022.

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains September 2022.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s September 2022 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web Application Scanning trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.cs Cloud Security.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try Tenable Lumin

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable.io Vulnerability Management, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable.cs

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now.

Your Tenable.cs Cloud Security trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.io Web Application Scanning.

Contact a Sales Rep to Buy Tenable.cs

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Promotional pricing extended until December 31st.
Buy a multi-year license and save more.

Add Support and Training