Microsoft security alert.
April 12, 2022
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 114 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Office Security Update for April 2022
- Severity
- Critical 4
- Qualys ID
- 110404
- Vendor Reference
- KB5002143, KB5002148, KB5002162, KB5002169, KB5002175, KB5002177
- CVE Reference
- CVE-2022-24473, CVE-2022-26901
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Microsoft has released April 2022 security updates to fix multiple security vulnerabilities.
This security update contains the following:
MacOS Release Notes
Office Click-2-Run and Office 365 Release Notes
KB5012681
KB5002169
KB5002148
KB5002175
KB5002143
KB5002177
KB5002162QID Detection Logic:
This authenticated QID checks the file versions from the Microsoft advisory with the versions on the affected office system.Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.
- Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
MacOS Release Notes
Office Click-2-Run and Office 365 Release Notes
KB5012681
KB5002169
KB5002148
KB5002175
KB5002143
KB5002177
KB5002162Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft office April 2022
-
Microsoft Skype for Business Server and Lync Server Security Update for April 2022
- Severity
- Serious 3
- Qualys ID
- 110405
- Vendor Reference
- KB3061064, KB5012681, KB5012686
- CVE Reference
- CVE-2022-26910, CVE-2022-26911
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
Microsoft has released updates to fix multiples updates to fix issues on Microsoft Skype for Business Server and Microsoft Lync Server..
Affected Software:
Microsoft Lync Server 2013
Microsoft Skype for Business Server 2015
Microsoft Skype for Business Server 2019 - Consequence
-
Successful exploitation of vulnerability can lead to Information Disclosure and Spoofing attacks.
- Solution
-
Customers are advised to refer to CVE-2022-26911 and CVE-2022-26910 for more details pertaining to the vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Update Guide
-
Microsoft SharePoint Enterprise Server and Foundation Multiple Vulnerabilities for April 2022
- Severity
- Critical 4
- Qualys ID
- 110406
- Vendor Reference
- KB5002180, KB5002183, KB5002189, KB5002191
- CVE Reference
- CVE-2022-24472, CVE-2022-26901
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Microsoft has released April 2022 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB5002189
KB5002183
KB5002191
KB5002180QID Detection Logic:
This authenticated QID checks the file versions from the above Microsoft KB article with the versions on the affected SharePoint system. - Consequence
-
Successful exploitation allows remote code execution.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
KB5002189
KB5002183
KB5002191
KB5002180Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Sharepoint
-
Microsoft Visual Studio Code Security Update for April 2022
- Severity
- Serious 3
- Qualys ID
- 376535
- Vendor Reference
- CVE-2022-26921
- CVE Reference
- CVE-2022-26921
- CVSS Scores
- Base 4.6 / Temporal 3.4
- Description
-
Visual Studio Code is a lightweight but powerful source code editor which runs on your desktop and is available for Windows, macOS and Linux.
Affected Versions:
Visual studio code prior to version 1.66.2
QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of Visual Studio Code.
- Consequence
-
Visual Studio Code is prone to Elevation of Privilege Vulnerability.
- Solution
-
Customers are advised to refer to CVE-2022-26921 and for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-26921
-
Microsoft Windows Security Update for April 2022
- Severity
- Critical 4
- Qualys ID
- 91879
- Vendor Reference
- KB5011529, KB5011552, KB5012591, KB5012592, KB5012596, KB5012599, KB5012604, KB5012626, KB5012632, KB5012639, KB5012647, KB5012649, KB5012650, KB5012653, KB5012658, KB5012666, KB5012670
- CVE Reference
- CVE-2022-21983, CVE-2022-22008, CVE-2022-22009, CVE-2022-23257, CVE-2022-23268, CVE-2022-24474, CVE-2022-24479, CVE-2022-24481, CVE-2022-24482, CVE-2022-24483, CVE-2022-24484, CVE-2022-24485, CVE-2022-24486, CVE-2022-24487, CVE-2022-24488, CVE-2022-24489, CVE-2022-24490, CVE-2022-24492, CVE-2022-24493, CVE-2022-24494, CVE-2022-24495, CVE-2022-24496, CVE-2022-24498, CVE-2022-24499, CVE-2022-24500, CVE-2022-24521, CVE-2022-24527, CVE-2022-24528, CVE-2022-24530, CVE-2022-24533, CVE-2022-24534, CVE-2022-24537, CVE-2022-24538, CVE-2022-24539, CVE-2022-24540, CVE-2022-24541, CVE-2022-24542, CVE-2022-24543, CVE-2022-24544, CVE-2022-24545, CVE-2022-24546, CVE-2022-24547, CVE-2022-24549, CVE-2022-24550, CVE-2022-26783, CVE-2022-26784, CVE-2022-26785, CVE-2022-26786, CVE-2022-26787, CVE-2022-26788, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803, CVE-2022-26807, CVE-2022-26808, CVE-2022-26809, CVE-2022-26810, CVE-2022-26827, CVE-2022-26828, CVE-2022-26830, CVE-2022-26831, CVE-2022-26903, CVE-2022-26904, CVE-2022-26914, CVE-2022-26915, CVE-2022-26916, CVE-2022-26917, CVE-2022-26918, CVE-2022-26919, CVE-2022-26920
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
Microsoft Windows Security Update - April 2022
The KB Articles associated with the update:
5012647
5012592
5012599
5012604
5012658
5012632
5012670
5012653
5012639
5012650
5012666
5011552
5011529
5012596
5012591
5012626
5012649
This QID checks for the file version of ntoskrnl.exe
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the 5012647
5012592
5012599
5012604
5012658
5012632
5012670
5012653
5012639
5012650
5012666
5011552
5011529
5012596
5012591
5012626
5012649
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5011529
KB5011552
KB5012591
KB5012592
KB5012596
KB5012599
KB5012604
KB5012626
KB5012632
KB5012639
KB5012647
KB5012649
KB5012650
KB5012653
KB5012658
KB5012666
KB5012670
-
Microsoft Defender Denial of Service (DoS) Vulnerability for April 2022
- Severity
- Serious 3
- Qualys ID
- 91880
- Vendor Reference
- CVE-2022-24548
- CVE Reference
- CVE-2022-24458, CVE-2022-24548
- CVSS Scores
- Base 4.3 / Temporal 3.2
- Description
-
A denial of service vulnerability exists when Microsoft Defender improperly handles files. An attacker could exploit the vulnerability to prevent legitimate accounts from executing legitimate system binaries.
Affected Products:
Microsoft System Center Endpoint Protection
Microsoft System Center 2012 R2 Endpoint Protection
Microsoft System Center 2012 Endpoint Protection
Microsoft Security Essentials.QID Detection Logic (Authenticated):
The authenticated check looks for the version of mpengine.dll file. - Consequence
-
Successful exploitation will cause Denial of Service attacks.
- Solution
-
Manually update the Microsoft Defender if It's not updated automatically.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-24548
-
Microsoft Visual Studio Security Update for April 2022
- Severity
- Serious 3
- Qualys ID
- 91881
- Vendor Reference
- CVE-2022-24513, CVE-2022-24765, CVE-2022-24767
- CVE Reference
- CVE-2022-24513, CVE-2022-24765, CVE-2022-24767
- CVSS Scores
- Base 6.9 / Temporal 5.7
- Description
-
Microsoft has released security Updates for Visual Studio which resolves Remote Code Execution and Denial of Service vulnerability.
Affected Software:
Microsoft Visual Studio 2022 Version 17.1
Microsoft Visual Studio 2022 Version 17.0
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 - 16.6)
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
and Microsoft VIsual Studio for Mac prior to 8.10.22.11
QID Detection Logic: Authenticated
This QID detects vulnerable versions of Microsoft Visual Studio by checking the file version of the Visual Studio.
- Consequence
-
Microsoft Visual Studio is prone to Elevation of Privilege Vulnerabilities
- Solution
-
Customers are advised to refer to CVE-2022-24765, CVE-2022-24513 and CVE-2022-24767 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-24513
CVE-2022-24765
CVE-2022-24767
-
Microsoft Dynamics 365 Security Update for April 2022
- Severity
- Critical 4
- Qualys ID
- 91882
- Vendor Reference
- CVE-2022-23259
- CVE Reference
- CVE-2022-23259
- CVSS Scores
- Base 9 / Temporal 6.7
- Description
-
Microsoft Dynamics 365 is a product line of enterprise resource planning and customer relationship management intelligent business applications.
CVE-2022-23259: Microsoft Dynamics 365 (on-premise) Remote Code Execution Vulnerability
Affected Software:
Microsoft Dynamics 365 (on-premises) V9.0
Microsoft Dynamics 365 (on-premises) V9.1QID Detection Logic(Authenticated):
This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file Microsoft.Crm.Setup.Server.exe:
- Consequence
- Successful exploitation of this vulnerability can result in remote code execution.
- Solution
-
Customers are advised to refer to CVE-2022-23259 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-23259
-
Microsoft Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
- Severity
- Serious 3
- Qualys ID
- 91883
- Vendor Reference
- KB5012596, KB5012599, KB5012604, KB5012647
- CVE Reference
- CVE-2022-24490, CVE-2022-24539, CVE-2022-26783, CVE-2022-26785
- CVSS Scores
- Base 6.8 / Temporal 5
- Description
-
Microsoft Hyper-V its release as Windows Server Virtualization, is a native hypervisor.it can create virtual machines on x86-64 systems running Windows.
CVE-2022-26785 - Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability.
CVE-2022-24539 - Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability.
CVE-2022-24490 - Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability.
CVE-2022-26783 - Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability.Microsoft releases the security update for Windows October 2021
The KB Articles associated with the update:
KB5012596
KB5012647
KB5012604
KB5012599
This QID checks for the file version of ntoskrnl.exe
This QID check for Hyper-V service
The following versions of ntoskrnl.exe with their corresponding KBs are verified:
KB5012596-10.0.14393.5066
KB5012647-10.0.17763.2803
KB5012604-10.0.20348.643
KB5012599-10.0.19042.1645
- Consequence
- Successfully exploited this vulnerability is the contents of Kernel memory. An attacker could read the contents of Kernel memory from a user mode process.
- Solution
-
Please refer to theKB5012596
KB5012647
,KB5012604
And KB5012599
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5012596
KB5012599
KB5012604
KB5012647
-
Microsoft Windows Security Update for Domain Name System (DNS) for April 2022
- Severity
- Critical 4
- Qualys ID
- 91884
- Vendor Reference
- KB5012596, KB5012599, KB5012604, KB5012626, KB5012632, KB5012639, KB5012647, KB5012649, KB5012650, KB5012658, KB5012666, KB5012670
- CVE Reference
- CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26816, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829
- CVSS Scores
- Base 9 / Temporal 6.7
- Description
-
Microsoft Windows Security Update - April 2022
The KB Articles associated with the update:
5012647
5012599
5012604
5012658
5012632
5012670
5012639
5012650
5012666
5012596
5012626
5012649
QID Detection Logic:
Authenticated: This QID checks for the file version of dns.exeUnauthenticated: This QID checks for vulnerable version of Microsoft DNS by checking the DNS version exposed in the banner.
- Consequence
-
Successful exploitation could compromised confidentiality, integrity and availability of the system
- Solution
-
Please refer to the 5012647
5012599
5012604
5012658
5012632
5012670
5012639
5012650
5012666
5012596
5012626
5012649
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5012596
KB5012599
KB5012604
KB5012626
KB5012632
KB5012639
KB5012647
KB5012649
KB5012650
KB5012658
KB5012666
KB5012670
-
Microsoft HEVC Video Extensions Remote Code Execution (RCE) Vulnerability for April 2022
- Severity
- Critical 4
- Qualys ID
- 91885
- Vendor Reference
- CVE-2022-24532
- CVE Reference
- CVE-2022-24532
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
A remote code execution vulnerability exists in the way that Microsoft Windows Extensions handle objects in memory.
Affected Product:
"HEVC from Device Manufacturer" media codec before version 1.0.50361.0QID detection Logic:
This gets the version of HEVCVideoExtension by querying WMI class Win32_InstalledStoreProgram. - Consequence
-
An attacker who successfully exploited this vulnerability can compromise confidentiality, integrity and availability of the system
- Solution
-
Users are advised to check CVE-2022-24532 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-24532
-
Microsoft Windows Cluster Shared Volume (CSV) Multiple Vulnerabilities for April 2022
- Severity
- Serious 3
- Qualys ID
- 91886
- Vendor Reference
- KB5012596, KB5012599, KB5012604, KB5012647, KB5012650, KB5012670
- CVE Reference
- CVE-2022-24484, CVE-2022-24489, CVE-2022-24538, CVE-2022-26784
- CVSS Scores
- Base 4.6 / Temporal 3.4
- Description
-
Microsoft releases the security update for Windows Cluster Shared Volume
The KB Articles associated with the update:
KB5012596
KB5012647
KB5012604
KB5012599
KB5012650
KB5012670
This QID checks for the file version of ntoskrnl.exe
The following versions of ntoskrnl.exe with their corresponding KBs are verified:
KB5012596-10.0.14393.5066
KB5012647-10.0.17763.2803
KB5012604-10.0.20348.643
KB5012599-10.0.19042.1645
KB5012650-6.2.9200.23670
KB5012670-6.3.9600.20326
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to theKB5012596
KB5012647
,KB5012604
,KB5012599
,KB5012650
And KB5012670
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5012596
KB5012599
KB5012604
KB5012647
KB5012650
KB5012670
-
Microsoft .NET Framework Denial of Service (DoS) Vulnerability for April 2022
- Severity
- Serious 3
- Qualys ID
- 91889
- Vendor Reference
- KB5012117, KB5012118, KB5012120, KB5012121, KB5012123, KB5012324, KB5012325, KB5012326, KB5012327, KB5012328, KB5012329, KB5012330, KB5012331, KB5012332
- CVE Reference
- CVE-2022-26832
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
A denial of service vulnerability exist in Microsoft .Net Framework.
Following KBs are covered in this detection:
KB5012117
KB5012118
KB5012120
KB5012121
KB5012123
KB5012324
KB5012325
KB5012326
KB5012327
KB5012328
KB5012329
KB5012330
KB5012331
KB5012332
This security update is rated Important for supported versions of Microsoft .NET Framework..NET Framework 3.5, 3.5.1, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 and 4.8
QID Detection Logic (Authenticated):
- Checks for vulnerable version of System.web.dll for .Net Framework
- Consequence
-
Successful exploitation allows attacker to cause denial of service vulnerability.
- Solution
-
Customers are advised to refer to CVE-2022-26832 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-26832
-
Microsoft Windows Network File System (NFS) Remote Code Execution (RCE) Vulnerability for April 2022
- Severity
- Critical 4
- Qualys ID
- 91890
- Vendor Reference
- CVE-2022-24491, CVE-2022-24497
- CVE Reference
- CVE-2022-24491, CVE-2022-24497
- CVSS Scores
- Base 7.5 / Temporal 5.5
- Description
-
Microsoft Windows Network File System is vulnerable to Remote Code Execution Vulnerability.
This vulnerability is only exploitable for systems that have the NFS role enabled.
The KB Articles associated with the update are:
5012591
5012592
5012596
5012599
5012604
5012639
5012647
5012650
5012653
5012666
5012670QID Detection Logic (Authenticated):
This QID checks for the file version of rpcxdr.sys.
- Consequence
-
An attacker could send a specially crafted NFS protocol network message to a vulnerable Windows machine, which could enable remote code execution.
- Solution
-
Please refer to the CVE-2022-24497 and CVE-2022-24491 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Update Guide
These new vulnerability checks are included in Qualys vulnerability signature 2.5.447-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110404
- 110405
- 110406
- 376535
- 91879
- 91880
- 91881
- 91882
- 91883
- 91884
- 91885
- 91886
- 91889
- 91890
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.