Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 79 vulnerabilities that were fixed in 11 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 11 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Office Security Update for August 2022

  Severity

  Critical 4

  Qualys ID

  110413

  Vendor Reference

  KB4462148, KB5001990, KB5002051, KB5002228, kb4462142, kb5002232, kb5002242

  CVE Reference

  CVE-2022-33631, CVE-2022-33648, CVE-2022-34717, CVE-2022-35742

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  Microsoft has released August 2022 security updates to fix multiple security vulnerabilities.

  This security update contains the following:

  kb4462142
  kb4462148
  KB5001990
  KB5002051
  KB5002228
  kb5002242
  kb5002232
  

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  kb4462142
  kb4462148
  KB5001990
  KB5002051
  KB5002228
  kb5002242
  kb5002232
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft office August 2022

• Microsoft Outlook Denial of Service (DoS) Vulnerability Security Update August 2022

  Severity

  Serious 3

  Qualys ID

  110414

  Vendor Reference

  KB5001990, KB5002051

  CVE Reference

  CVE-2022-35742

  CVSS Scores

  Base 7.8 / Temporal 5.8

  Description

  Microsoft has released August 2022 security updates for outlook to fix a Remote Code Execution vulnerability.

  This security update contains the following KBs:
  KB5001990
  KB5002051
  QID Detection Logic:
  This authenticated QID checks the file versions from the Microsoft advisory with the versions on affected outlook applications.

  Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.

  Consequence

  Successful exploitation will lead to Remote Code Execution.

  Solution

  Refer to Microsoft Security Guide, KB5002051, KB5001990 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Outlook Denial of Service Vulnerability Security Update August 2022

• Azure Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability for August 2022

  Severity

  Critical 4

  Qualys ID

  376813

  Vendor Reference

  CVE-2022-33640

  CVE Reference

  CVE-2022-33640

  CVSS Scores

  Base 4.6 / Temporal 3.6

  Description

  Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint.

  Affected Software:
  Azure Open Management Infrastructure prior to v1.6.10-2
  

  QID Detection Logic (Authenticated):
  The QID checks for the vulnerable version of omi package installed on the system.
  

  Consequence

  Successful exploitation allows an attacker to conduct Elevation of Privilege and Remote Code Execution Vulnerability.

  Solution

  Customers are advised to refer to CVE-2022-33640 for more details pertaining to this vulnerability

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-33640

• Microsoft Exchange Server Elevation of Privilege Vulnerability for August 2022

  Severity

  Critical 4

  Qualys ID

  50121

  Vendor Reference

  KB5015321, KB5015322

  CVE Reference

  CVE-2022-21979, CVE-2022-21980, CVE-2022-24477, CVE-2022-24516, CVE-2022-30134

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  Microsoft Exchange Server is prone to multiple vulnerabilities:

  Microsoft Exchange Server Elevation of Privilege Vulnerability
  KB Articles associated with this update are: KB5015321, KB5015322

  Affected Versions:
  Microsoft Exchange Server 2013 Cumulative Update 23
  Microsoft Exchange Server 2019 Cumulative Update 11
  Microsoft Exchange Server 2019 Cumulative Update 12
  Microsoft Exchange Server 2016 Cumulative Update 23
  Microsoft Exchange Server 2016 Cumulative Update 22
  QID Detection Logic (authenticated):
  The QID checks for the version of file Exsetup.exe.
  

  Consequence

  Successful exploitation allows Elevation of privilege.
  

  Solution

  Customers are advised to refer to KB5015321 KB5015322 for information pertaining to this vulnerability.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5015321
  KB5015322

• Microsoft Windows Network File System (NFS) Remote Code Execution (RCE) Vulnerability for August 2022

  Severity

  Critical 4

  Qualys ID

  91929

  Vendor Reference

  CVE-2022-34715

  CVE Reference

  CVE-2022-34715

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  Microsoft Windows Network File System is vulnerable to Remote Code Execution Vulnerability.

  This vulnerability is not exploitable in NFSV2.0 or NFSV3.0

  The KB Articles associated with the update are:
  KB5016627

  QID Detection Logic (Authenticated):
  Operating System: Windows Server 2022 and Windows Server 2022 Core
  

  This QID checks for the file version of nfssvr.sys and checks if the mitigations have been applied.

  Consequence

  This vulnerability could be exploited over the network by making an unauthenticated, specially crafted call to a Network File System (NFS) service to trigger a Remote Code Execution (RCE).

  Solution

  Please refer to the CVE-2022-34715 for more information pertaining to the vulnerability.

  Workaround:
  The following PowerShell command will disable the affected NFS server versions:
  PS C:\Set-NfsServerConfiguration -EnableNFSV4 $false

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5016627

• Microsoft Windows Security Update for August 2022

  Severity

  Critical 4

  Qualys ID

  91931

  Vendor Reference

  5012170, 5016616, 5016622, 5016623, 5016627, 5016629, 5016639, 5016669, 5016672, 5016676, 5016679, 5016681, 5016683, 5016684, 5016686

  CVE Reference

  CVE-2022-30133, CVE-2022-30144, CVE-2022-30194, CVE-2022-30197, CVE-2022-33670, CVE-2022-34301, CVE-2022-34302, CVE-2022-34303, CVE-2022-34690, CVE-2022-34691, CVE-2022-34696, CVE-2022-34699, CVE-2022-34701, CVE-2022-34702, CVE-2022-34703, CVE-2022-34704, CVE-2022-34705, CVE-2022-34706, CVE-2022-34707, CVE-2022-34708, CVE-2022-34709, CVE-2022-34710, CVE-2022-34711, CVE-2022-34712, CVE-2022-34713, CVE-2022-34714, CVE-2022-35743, CVE-2022-35744, CVE-2022-35745, CVE-2022-35746, CVE-2022-35747, CVE-2022-35749, CVE-2022-35750, CVE-2022-35751, CVE-2022-35752, CVE-2022-35753, CVE-2022-35754, CVE-2022-35755, CVE-2022-35756, CVE-2022-35757, CVE-2022-35758, CVE-2022-35759, CVE-2022-35760, CVE-2022-35761, CVE-2022-35762, CVE-2022-35763, CVE-2022-35764, CVE-2022-35765, CVE-2022-35766, CVE-2022-35767, CVE-2022-35768, CVE-2022-35769, CVE-2022-35771, CVE-2022-35792, CVE-2022-35793, CVE-2022-35794, CVE-2022-35795, CVE-2022-35797, CVE-2022-35820, CVE-2022-35822

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Microsoft Windows Security Update - Aug 2022

  The KB Articles associated with the update:
  5016623
  5016622
  5016639
  5016616
  5016627
  5016681
  5016683
  5016676
  5016679
  5012170
  5016672
  5016684
  5016669
  5016629
  5016686
  

  This QID checks for the file version of ntoskrnl.exe and advapi32.dll

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Please refer to the5016623
  5016622
  5016639
  5016616
  5016627
  5016681
  5016683
  5016676
  5016679
  5012170
  5016672
  5016684
  5016669
  5016629
  5016686
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  5012170
  5016616
  5016622
  5016623
  5016627
  5016629
  5016639
  5016669
  5016672
  5016676
  5016679
  5016681
  5016683
  5016684
  5016686

• Microsoft Visual Studio Security Update for August 2022

  Severity

  Critical 4

  Qualys ID

  91932

  Vendor Reference

  CVE-2022-35777, CVE-2022-35825, CVE-2022-35826, CVE-2022-35827

  CVE Reference

  CVE-2022-35777, CVE-2022-35825, CVE-2022-35826, CVE-2022-35827

  CVSS Scores

  Base 9 / Temporal 7

  Description

  Microsoft has released security Updates for Visual Studio which resolves Remote Code Execution Vulnerabilities.

  Affected Software:
  Microsoft Visual Studio 2012 Update 5
  Microsoft Visual Studio 2013 Update 5
  Microsoft Visual Studio 2015 Update 3
  Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
  Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  Microsoft Visual Studio 2022 Version 17.0
  and Microsoft Visual Studio 2022 version 17.2
  

  QID Detection Logic: Authenticated
  This QID detects vulnerable versions of Microsoft Visual Studio by checking the file version of the Visual Studio.
  

  Consequence

  Vulnerable versions of Microsoft Visual Studio are prone to Remote Code Execution Vulnerabilities.
  

  Solution

  Customers are advised to refer to CVE-2022-35777, CVE-2022-35827, CVE-2022-35826, and CVE-2022-35825 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-35777
  CVE-2022-35825
  CVE-2022-35826
  CVE-2022-35827

• Microsoft .NET Security Update for August 2022

  Severity

  Serious 3

  Qualys ID

  91933

  Vendor Reference

  CVE-2022-34716

  CVE Reference

  CVE-2022-34716

  CVSS Scores

  Base 5.4 / Temporal 4.2

  Description

  Microsoft has released a security Update for .NET which resolves Spoofing Vulnerability.
  This security update is rated Important for affected versions of .NET

  Affected versions:
  .NET 6.0 before version 6.0.8
  and .NET Core 3.1 before version 3.1.28
  

  QID Detection Logic: Authenticated
  This QID detects vulnerable versions of Microsoft .NET Core by checking the file version on windows.
  

  Consequence

  
  Vulnerable versions of Microsoft .NET are prone to Spoofing Vulnerability.
  

  Solution

  Customers are advised to refer to CVE-2022-34716 for more information pertaining to these vulnerabilities.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-34716

• Microsoft Windows HTTP.sys Denial of Service (DoS) Vulnerability for August 2022

  Severity

  Serious 3

  Qualys ID

  91934

  Vendor Reference

  CVE-2022-35748

  CVE Reference

  CVE-2022-35748

  CVSS Scores

  Base 7.8 / Temporal 5.8

  Description

  A Denial of Service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys)

  The KB Articles associated with the update are:
  5016681
  5016683
  5016672
  5016684
  5016622
  5016616
  5016627
  5016623

  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of http.sys.

  Consequence

  In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the Server Name Indication (SNI) over HTTP Protocol Stack (http.sys) to process packets, causing a denial of service (DOS).

  Solution

  Please refer to the CVE-2022-35748 for more information pertaining to the vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  5016616
  5016622
  5016623
  5016627
  5016672
  5016681
  5016683
  5016684

• Microsoft Windows SMB Client and Server Remote Code Execution (RCE) Vulnerability for August 2022

  Severity

  Critical 4

  Qualys ID

  91935

  Vendor Reference

  5016629

  CVE Reference

  CVE-2022-35804

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  Microsoft Windows Security Update - Aug 2022

  The KB Articles associated with the update:
  5016629
  

  This QID checks for the file version of ntoskrnl.exe

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Please refer to the5016629
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  5016629

• Microsoft Azure Stack Hub Security Updates for August 2022

  Severity

  Critical 4

  Qualys ID

  91936

  Vendor Reference

  Azure Stack Hub

  CVE Reference

  CVE-2022-21979, CVE-2022-21980, CVE-2022-24477, CVE-2022-24516, CVE-2022-30133, CVE-2022-30134, CVE-2022-30194, CVE-2022-30197, CVE-2022-33670, CVE-2022-34301, CVE-2022-34302, CVE-2022-34303, CVE-2022-34690, CVE-2022-34691, CVE-2022-34692, CVE-2022-34696, CVE-2022-34699, CVE-2022-34701, CVE-2022-34702, CVE-2022-34703, CVE-2022-34704, CVE-2022-34705, CVE-2022-34706, CVE-2022-34707, CVE-2022-34708, CVE-2022-34709, CVE-2022-34710, CVE-2022-34713, CVE-2022-34714, CVE-2022-35743, CVE-2022-35744, CVE-2022-35745, CVE-2022-35746, CVE-2022-35747, CVE-2022-35748, CVE-2022-35749, CVE-2022-35750, CVE-2022-35751, CVE-2022-35752, CVE-2022-35753, CVE-2022-35754, CVE-2022-35755, CVE-2022-35756, CVE-2022-35757, CVE-2022-35758, CVE-2022-35759, CVE-2022-35760, CVE-2022-35761, CVE-2022-35762, CVE-2022-35763, CVE-2022-35764, CVE-2022-35765, CVE-2022-35766, CVE-2022-35767, CVE-2022-35768, CVE-2022-35769, CVE-2022-35771, CVE-2022-35792, CVE-2022-35793, CVE-2022-35794, CVE-2022-35795, CVE-2022-35820

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Azure Stack Hub is an extension of Azure that provides a way to run apps in an on-premises environment and deliver Azure services in your datacenter.

  A complete Qualys vulnerability scan report for Microsoft Azure Stack Hub can be obtained at Azure Stack Vulnerability Scan Report.

  QID Detection Logic (Authenticated):
  This QID checks for the file version of ntoskrnl.exe, if this file version is less than 10.0.17763.10935, it is considered as vulnerable.
  

  Consequence

  Successful exploitation of these vulnerabilities might allow an attacker to perform Information Disclosure, Elevation of Privileges, Security Feature Bypass, Remote Code Execution, and Denial of Service attacks.

  Solution

  Customers are encouraged to connect with Microsoft for obtaining more information about patches and upcoming releases.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Azure Stack Hub

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.