Microsoft security alert.
August 9, 2022
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 79 vulnerabilities that were fixed in 11 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 11 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Office Security Update for August 2022
- Severity
- Critical 4
- Qualys ID
- 110413
- Vendor Reference
- KB4462148, KB5001990, KB5002051, KB5002228, kb4462142, kb5002232, kb5002242
- CVE Reference
- CVE-2022-33631, CVE-2022-33648, CVE-2022-34717, CVE-2022-35742
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
Microsoft has released August 2022 security updates to fix multiple security vulnerabilities.
This security update contains the following:
kb4462142
kb4462148
KB5001990
KB5002051
KB5002228
kb5002242
kb5002232
- Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
kb4462142
kb4462148
KB5001990
KB5002051
KB5002228
kb5002242
kb5002232
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft office August 2022
-
Microsoft Outlook Denial of Service (DoS) Vulnerability Security Update August 2022
- Severity
- Serious 3
- Qualys ID
- 110414
- Vendor Reference
- KB5001990, KB5002051
- CVE Reference
- CVE-2022-35742
- CVSS Scores
- Base 7.8 / Temporal 5.8
- Description
-
Microsoft has released August 2022 security updates for outlook to fix a Remote Code Execution vulnerability.
This security update contains the following KBs:
KB5001990
KB5002051
QID Detection Logic:
This authenticated QID checks the file versions from the Microsoft advisory with the versions on affected outlook applications.Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.
- Consequence
-
Successful exploitation will lead to Remote Code Execution.
- Solution
-
Refer to Microsoft Security Guide, KB5002051, KB5001990 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Outlook Denial of Service Vulnerability Security Update August 2022
-
Azure Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability for August 2022
- Severity
- Critical 4
- Qualys ID
- 376813
- Vendor Reference
- CVE-2022-33640
- CVE Reference
- CVE-2022-33640
- CVSS Scores
- Base 4.6 / Temporal 3.6
- Description
-
Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint.
Affected Software:
Azure Open Management Infrastructure prior to v1.6.10-2
QID Detection Logic (Authenticated):
The QID checks for the vulnerable version of omi package installed on the system.
- Consequence
- Successful exploitation allows an attacker to conduct Elevation of Privilege and Remote Code Execution Vulnerability.
- Solution
-
Customers are advised to refer to CVE-2022-33640 for more details pertaining to this vulnerability
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-33640
-
Microsoft Exchange Server Elevation of Privilege Vulnerability for August 2022
- Severity
- Critical 4
- Qualys ID
- 50121
- Vendor Reference
- KB5015321, KB5015322
- CVE Reference
- CVE-2022-21979, CVE-2022-21980, CVE-2022-24477, CVE-2022-24516, CVE-2022-30134
- CVSS Scores
- Base 7.2 / Temporal 5.3
- Description
-
Microsoft Exchange Server is prone to multiple vulnerabilities:
Microsoft Exchange Server Elevation of Privilege Vulnerability
KB Articles associated with this update are: KB5015321, KB5015322Affected Versions:
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2016 Cumulative Update 22
QID Detection Logic (authenticated):
The QID checks for the version of file Exsetup.exe.
- Consequence
-
Successful exploitation allows Elevation of privilege.
- Solution
-
Customers are advised to refer to KB5015321 KB5015322 for information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5015321
KB5015322
-
Microsoft Windows Network File System (NFS) Remote Code Execution (RCE) Vulnerability for August 2022
- Severity
- Critical 4
- Qualys ID
- 91929
- Vendor Reference
- CVE-2022-34715
- CVE Reference
- CVE-2022-34715
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
Microsoft Windows Network File System is vulnerable to Remote Code Execution Vulnerability.
This vulnerability is not exploitable in NFSV2.0 or NFSV3.0
The KB Articles associated with the update are:
KB5016627QID Detection Logic (Authenticated):
Operating System: Windows Server 2022 and Windows Server 2022 Core
This QID checks for the file version of nfssvr.sys and checks if the mitigations have been applied.
- Consequence
-
This vulnerability could be exploited over the network by making an unauthenticated, specially crafted call to a Network File System (NFS) service to trigger a Remote Code Execution (RCE).
- Solution
-
Please refer to the CVE-2022-34715 for more information pertaining to the vulnerability.
Workaround:
The following PowerShell command will disable the affected NFS server versions:
PS C:\Set-NfsServerConfiguration -EnableNFSV4 $falsePatches:
The following are links for downloading patches to fix these vulnerabilities:
KB5016627
-
Microsoft Windows Security Update for August 2022
- Severity
- Critical 4
- Qualys ID
- 91931
- Vendor Reference
- 5012170, 5016616, 5016622, 5016623, 5016627, 5016629, 5016639, 5016669, 5016672, 5016676, 5016679, 5016681, 5016683, 5016684, 5016686
- CVE Reference
- CVE-2022-30133, CVE-2022-30144, CVE-2022-30194, CVE-2022-30197, CVE-2022-33670, CVE-2022-34301, CVE-2022-34302, CVE-2022-34303, CVE-2022-34690, CVE-2022-34691, CVE-2022-34696, CVE-2022-34699, CVE-2022-34701, CVE-2022-34702, CVE-2022-34703, CVE-2022-34704, CVE-2022-34705, CVE-2022-34706, CVE-2022-34707, CVE-2022-34708, CVE-2022-34709, CVE-2022-34710, CVE-2022-34711, CVE-2022-34712, CVE-2022-34713, CVE-2022-34714, CVE-2022-35743, CVE-2022-35744, CVE-2022-35745, CVE-2022-35746, CVE-2022-35747, CVE-2022-35749, CVE-2022-35750, CVE-2022-35751, CVE-2022-35752, CVE-2022-35753, CVE-2022-35754, CVE-2022-35755, CVE-2022-35756, CVE-2022-35757, CVE-2022-35758, CVE-2022-35759, CVE-2022-35760, CVE-2022-35761, CVE-2022-35762, CVE-2022-35763, CVE-2022-35764, CVE-2022-35765, CVE-2022-35766, CVE-2022-35767, CVE-2022-35768, CVE-2022-35769, CVE-2022-35771, CVE-2022-35792, CVE-2022-35793, CVE-2022-35794, CVE-2022-35795, CVE-2022-35797, CVE-2022-35820, CVE-2022-35822
- CVSS Scores
- Base 7.6 / Temporal 6.3
- Description
-
Microsoft Windows Security Update - Aug 2022
The KB Articles associated with the update:
5016623
5016622
5016639
5016616
5016627
5016681
5016683
5016676
5016679
5012170
5016672
5016684
5016669
5016629
5016686
This QID checks for the file version of ntoskrnl.exe and advapi32.dll
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the5016623
5016622
5016639
5016616
5016627
5016681
5016683
5016676
5016679
5012170
5016672
5016684
5016669
5016629
5016686
Patches:
The following are links for downloading patches to fix these vulnerabilities:
5012170
5016616
5016622
5016623
5016627
5016629
5016639
5016669
5016672
5016676
5016679
5016681
5016683
5016684
5016686
-
Microsoft Visual Studio Security Update for August 2022
- Severity
- Critical 4
- Qualys ID
- 91932
- Vendor Reference
- CVE-2022-35777, CVE-2022-35825, CVE-2022-35826, CVE-2022-35827
- CVE Reference
- CVE-2022-35777, CVE-2022-35825, CVE-2022-35826, CVE-2022-35827
- CVSS Scores
- Base 9 / Temporal 7
- Description
-
Microsoft has released security Updates for Visual Studio which resolves Remote Code Execution Vulnerabilities.
Affected Software:
Microsoft Visual Studio 2012 Update 5
Microsoft Visual Studio 2013 Update 5
Microsoft Visual Studio 2015 Update 3
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft Visual Studio 2022 Version 17.0
and Microsoft Visual Studio 2022 version 17.2
QID Detection Logic: Authenticated
This QID detects vulnerable versions of Microsoft Visual Studio by checking the file version of the Visual Studio.
- Consequence
-
Vulnerable versions of Microsoft Visual Studio are prone to Remote Code Execution Vulnerabilities.
- Solution
-
Customers are advised to refer to CVE-2022-35777, CVE-2022-35827, CVE-2022-35826, and CVE-2022-35825 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-35777
CVE-2022-35825
CVE-2022-35826
CVE-2022-35827
-
Microsoft .NET Security Update for August 2022
- Severity
- Serious 3
- Qualys ID
- 91933
- Vendor Reference
- CVE-2022-34716
- CVE Reference
- CVE-2022-34716
- CVSS Scores
- Base 5.4 / Temporal 4.2
- Description
-
Microsoft has released a security Update for .NET which resolves Spoofing Vulnerability.
This security update is rated Important for affected versions of .NETAffected versions:
.NET 6.0 before version 6.0.8
and .NET Core 3.1 before version 3.1.28
QID Detection Logic: Authenticated
This QID detects vulnerable versions of Microsoft .NET Core by checking the file version on windows.
- Consequence
-
Vulnerable versions of Microsoft .NET are prone to Spoofing Vulnerability.
- Solution
-
Customers are advised to refer to CVE-2022-34716 for more information pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2022-34716
-
Microsoft Windows HTTP.sys Denial of Service (DoS) Vulnerability for August 2022
- Severity
- Serious 3
- Qualys ID
- 91934
- Vendor Reference
- CVE-2022-35748
- CVE Reference
- CVE-2022-35748
- CVSS Scores
- Base 7.8 / Temporal 5.8
- Description
-
A Denial of Service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys)
The KB Articles associated with the update are:
5016681
5016683
5016672
5016684
5016622
5016616
5016627
5016623QID Detection Logic (Authenticated):
This QID checks for the file version of http.sys.
- Consequence
-
In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the Server Name Indication (SNI) over HTTP Protocol Stack (http.sys) to process packets, causing a denial of service (DOS).
- Solution
-
Please refer to the CVE-2022-35748 for more information pertaining to the vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
5016616
5016622
5016623
5016627
5016672
5016681
5016683
5016684
-
Microsoft Windows SMB Client and Server Remote Code Execution (RCE) Vulnerability for August 2022
- Severity
- Critical 4
- Qualys ID
- 91935
- Vendor Reference
- 5016629
- CVE Reference
- CVE-2022-35804
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
Microsoft Windows Security Update - Aug 2022
The KB Articles associated with the update:
5016629
This QID checks for the file version of ntoskrnl.exe
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the5016629
Patches:
The following are links for downloading patches to fix these vulnerabilities:
5016629
-
Microsoft Azure Stack Hub Security Updates for August 2022
- Severity
- Critical 4
- Qualys ID
- 91936
- Vendor Reference
- Azure Stack Hub
- CVE Reference
- CVE-2022-21979, CVE-2022-21980, CVE-2022-24477, CVE-2022-24516, CVE-2022-30133, CVE-2022-30134, CVE-2022-30194, CVE-2022-30197, CVE-2022-33670, CVE-2022-34301, CVE-2022-34302, CVE-2022-34303, CVE-2022-34690, CVE-2022-34691, CVE-2022-34692, CVE-2022-34696, CVE-2022-34699, CVE-2022-34701, CVE-2022-34702, CVE-2022-34703, CVE-2022-34704, CVE-2022-34705, CVE-2022-34706, CVE-2022-34707, CVE-2022-34708, CVE-2022-34709, CVE-2022-34710, CVE-2022-34713, CVE-2022-34714, CVE-2022-35743, CVE-2022-35744, CVE-2022-35745, CVE-2022-35746, CVE-2022-35747, CVE-2022-35748, CVE-2022-35749, CVE-2022-35750, CVE-2022-35751, CVE-2022-35752, CVE-2022-35753, CVE-2022-35754, CVE-2022-35755, CVE-2022-35756, CVE-2022-35757, CVE-2022-35758, CVE-2022-35759, CVE-2022-35760, CVE-2022-35761, CVE-2022-35762, CVE-2022-35763, CVE-2022-35764, CVE-2022-35765, CVE-2022-35766, CVE-2022-35767, CVE-2022-35768, CVE-2022-35769, CVE-2022-35771, CVE-2022-35792, CVE-2022-35793, CVE-2022-35794, CVE-2022-35795, CVE-2022-35820
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
Azure Stack Hub is an extension of Azure that provides a way to run apps in an on-premises environment and deliver Azure services in your datacenter.
A complete Qualys vulnerability scan report for Microsoft Azure Stack Hub can be obtained at Azure Stack Vulnerability Scan Report.
QID Detection Logic (Authenticated):
This QID checks for the file version of ntoskrnl.exe, if this file version is less than 10.0.17763.10935, it is considered as vulnerable.
- Consequence
-
Successful exploitation of these vulnerabilities might allow an attacker to perform Information Disclosure, Elevation of Privileges, Security Feature Bypass, Remote Code Execution, and Denial of Service attacks.
- Solution
-
Customers are encouraged to connect with Microsoft for obtaining more information about patches and upcoming releases.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Azure Stack Hub
These new vulnerability checks are included in Qualys vulnerability signature 2.5.551-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110413
- 110414
- 376813
- 50121
- 91929
- 91931
- 91932
- 91933
- 91934
- 91935
- 91936
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.