Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 55 vulnerabilities that were fixed in 16 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 16 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Office Security Update for June 2022

  Severity

  Critical 4

  Qualys ID

  110409

  Vendor Reference

  kb5002208, kb5002210, kb5002214, kb5002220

  CVE Reference

  CVE-2022-30159, CVE-2022-30171, CVE-2022-30172, CVE-2022-30173, CVE-2022-30174

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Microsoft has released June 2022 security updates to fix multiple security vulnerabilities.

  This security update contains the following:

  MacOS and Microsoft 365 Apps Release Notes
  kb5002214
  kb5002220
  kb5002208
  kb5002210
  QID Detection Logic:
  This authenticated QID checks the file versions from the Microsoft advisory with the versions on the affected office system.

  Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  MacOS and Microsoft 365 Apps Release Notes
  kb5002214
  kb5002220
  kb5002208
  kb5002210
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft office June 2022

• Microsoft SharePoint Server and Foundation Update for June 2022

  Severity

  Critical 4

  Qualys ID

  110410

  Vendor Reference

  KB5002167, kb5002062, kb5002212, kb5002218, kb5002219, kb5002222, kb5002224

  CVE Reference

  CVE-2022-30157, CVE-2022-30158, CVE-2022-30159, CVE-2022-30171, CVE-2022-30172

  CVSS Scores

  Base 6.5 / Temporal 4.8

  Description

  Microsoft has released June 2022 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:

  kb5002062
  kb5002212
  kb5002218
  kb5002219
  kb5002222
  kb5002224
  kb5002167
  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected SharePoint system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  kb5002062
  kb5002212
  kb5002218
  kb5002219
  kb5002222
  kb5002224
  kb5002167
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft SharePoint Foundation and SharePoint Server

• Azure Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability for June 2022

  Severity

  Serious 3

  Qualys ID

  376665

  Vendor Reference

  CVE-2022-29149

  CVE Reference

  CVE-2022-29149

  CVSS Scores

  Base 4.6 / Temporal 3.4

  Description

  Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint.

  Affected Software:
  Azure Open Management Infrastructure prior to v1.6.9-1
  

  QID Detection Logic (Authenticated):
  The QID checks for the vulnerable version of omi package installed on the system.
  

  Consequence

  Successful exploitation allows an attacker to conduct Elevation of Privilege and Remote Code Execution Vulnerability.

  Solution

  Customers are advised to refer to CVE-2022-29149 for more details pertaining to this vulnerability

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-29149

• Microsoft Edge Based on Chromium Prior to 102.0.1245.41 Multiple Vulnerabilities

  Severity

  Critical 4

  Qualys ID

  376666

  Vendor Reference

  CVE-2022-2007, CVE-2022-2008, CVE-2022-2010, CVE-2022-2011

  CVE Reference

  CVE-2022-2007, CVE-2022-2008, CVE-2022-2010, CVE-2022-2011

  CVSS Scores

  Base 5.4 / Temporal 4.3

  Description

  EdgeChromium has released security update for Mac and Windows to fix the vulnerabilities.
  QID Detection Logic: (Authenticated).
  It checks package versions to check for the vulnerable packages.

  Consequence

  Successful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.

  Solution

  Customers are advised to upgrade to version 102.0.1245.41 or later

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-2007
  CVE-2022-2008
  CVE-2022-2010
  CVE-2022-2011

• Microsoft Support Diagnostic Tool (MSDT) URL Protocol Vulnerability Disabled (Follina Mitigation Applied)

  Severity

  Minimal 1

  Qualys ID

  45538

  Vendor Reference

  MSDT URL Protocol

  CVE Reference

  N/A

  CVSS Scores

  Base / Temporal

  Description

  A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the users rights.

  Disabling MSDT URL protocol prevents troubleshooters being launched as links including links throughout the operating system.
  To disable this MSDT URL Protocol, Microsoft suggests users to delete the registry key "HKEY_CLASSES_ROOT\ms-msdt"
  

  QID Detection Logic (Authenticated):
  This QID checks for the file "windir\system32\msdt.exe" existence, and also check for the registry key "HKCR\ms-msdt" is missing.
  

  Consequence

  N/A

  Solution

  N/A

• Microsoft SQL Server Remote Code Execution (RCE) Vulnerability for June 2022

  Severity

  Critical 4

  Qualys ID

  91910

  Vendor Reference

  CVE-2022-29143

  CVE Reference

  CVE-2022-29143

  CVSS Scores

  Base 6 / Temporal 4.4

  Description

  Microsoft SQL Server Remote Code Execution Vulnerability. Affected Software:
  SQL Server 2019 RTM GDR
  SQL Server 2019 RTM CU16
  SQL Server 2017 RTM GDR
  SQL Server 2017 RTM CU29
  SQL Server 2016 Service Pack 2 (GDR)
  SQL Server 2016 Service Pack 2 CU17
  SQL Server 2016 Service Pack 3
  SQL Server 2016 Service Pack 3 Azure Connectivity Pack
  SQL Server 2014 Service Pack 3 (GDR)
  SQL Server 2014 Service Pack 3 CU4

  QID Detection Logic (Authenticated):
  Detection looks for Microsoft SQL Server instances and checks sqlservr.exe file version

  Consequence

  An authenticated attacker could exploit the vulnerability by executing a specially crafted query using $ partition against a table with a Column Store index.

  Solution

  Customers are advised to refer to CVE-2022-29143 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft SQL Server

• Microsoft Windows Network File System (NFS) Remote Code Execution (RCE) Vulnerability for June 2022

  Severity

  Critical 4

  Qualys ID

  91911

  Vendor Reference

  CVE-2022-30136

  CVE Reference

  CVE-2022-30136

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  Microsoft Windows Network File System is vulnerable to Remote Code Execution Vulnerability.

  This vulnerability is not exploitable in NFSV2.0 or NFSV3.0.

  The KB Articles associated with the update are:
  5014692
  5014702
  5014738
  5014741
  5014746
  5014747

  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of nfssvr.sys.

  Consequence

  An attacker could send a specially crafted NFS protocol network message to a vulnerable Windows machine, which could enable remote code execution.

  Solution

  Please refer to the CVE-2022-30136 for more information pertaining to these vulnerabilities.

  Workaround:
  The following PowerShell command will disable the affected versions:
  PS C:\Set-NfsServerConfiguration -EnableNFSV4 $false

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  5014692
  5014702
  5014738
  5014741
  5014746
  5014747

• Microsoft Visual Studio Security Update for June 2022

  Severity

  Serious 3

  Qualys ID

  91912

  Vendor Reference

  CVE-2022-30184

  CVE Reference

  CVE-2022-30184

  CVSS Scores

  Base 4.3 / Temporal 3.4

  Description

  Microsoft has released security Updates for Visual Studio which resolves Information Disclosure Vulnerability.

  Affected Software:
  Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
  Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  Microsoft Visual Studio 2022 Version 17.0
  Microsoft Visual Studio 2022 Version 17.2
  Visual Studio 2019 for Mac version 8.10
  and Visual Studio 2022 for Mac version 17.0
  

  QID Detection Logic: Authenticated
  This QID detects vulnerable versions of Microsoft Visual Studio by checking the file version of the Visual Studio.
  

  Consequence

  Microsoft Visual Studio 2019 16.9, 2022 17.0, 2022 17.2, 2019 for Mac version 8.10, and 2022 for Mac version 17.0 are prone to Information Disclosure Vulnerability.
  

  Solution

  Customers are advised to refer to CVE-2022-30184 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-30184

• Microsoft .NET Security Update for June 2022

  Severity

  Serious 3

  Qualys ID

  91913

  Vendor Reference

  CVE-2022-30184

  CVE Reference

  CVE-2022-30184

  CVSS Scores

  Base 4.3 / Temporal 3.4

  Description

  Microsoft has released a security Update for .NET which resolves Information Disclosure Vulnerability.
  This security update is rated Important for affected versions of .NET

  Affected versions:
  .NET 6.0 before version 6.0.6
  and .NET Core 3.1 before version 3.1.26
  

  QID Detection Logic: Authenticated
  This QID detects vulnerable versions of Microsoft .NET Core by checking the file version on windows.
  

  Consequence

  Successful exploitation of this vulnerability could lead to Information Disclosure.
  

  Solution

  Customers are advised to refer to CVE-2022-30184 for more information pertaining to these vulnerabilities.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-30184

• Microsoft Photos App Remote Code Execution (RCE) Vulnerability for June 2022

  Severity

  Critical 4

  Qualys ID

  91914

  Vendor Reference

  CVE-2022-30168

  CVE Reference

  CVE-2022-30168

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  
  Microsoft Photos is a single-instance app that can organize digital photos in its gallery into albums.

  CVE-2022-30168: Microsoft Photos App Remote Code Execution Vulnerability
  Affected Versions:
  Microsoft Photos App prior to version 2022.30050.31008.0
  QID detection Logic:
  The detection gets the version of Microsoft Photos App by querying wmi query.

  Consequence

  A successful exploit of this vulnerability could lead to execute remote code execution on a machine.

  Solution

  Users are advised to check CVE-2022-30168 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-30168

• Microsoft Windows Security Update for June 2022

  Severity

  Critical 4

  Qualys ID

  91915

  Vendor Reference

  KB5013941, KB5013942, KB5013943, KB5013945, KB5014678, KB5014692, KB5014697, KB5014699, KB5014702, KB5014710, KB5014738, KB5014741, KB5014742, KB5014743, KB5014746, KB5014747, KB5014748, KB5014752

  CVE Reference

  CVE-2022-21123, CVE-2022-21125, CVE-2022-21127, CVE-2022-21166, CVE-2022-22018, CVE-2022-29111, CVE-2022-29119, CVE-2022-30132, CVE-2022-30135, CVE-2022-30139, CVE-2022-30140, CVE-2022-30141, CVE-2022-30142, CVE-2022-30143, CVE-2022-30145, CVE-2022-30146, CVE-2022-30147, CVE-2022-30148, CVE-2022-30149, CVE-2022-30150, CVE-2022-30151, CVE-2022-30152, CVE-2022-30153, CVE-2022-30154, CVE-2022-30155, CVE-2022-30160, CVE-2022-30161, CVE-2022-30162, CVE-2022-30163, CVE-2022-30164, CVE-2022-30165, CVE-2022-30166, CVE-2022-30167, CVE-2022-30188, CVE-2022-30189, CVE-2022-30193, CVE-2022-32230

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Microsoft Windows Security Update - June 2022

  The KB Articles associated with the update:
  5013942
  5013943
  5013941
  5013945
  5014738
  5014746
  5014747
  5014741
  5014748
  5014742
  5014752
  5014743
  5014702
  5014710
  5014699
  5014697
  5014678
  5014692
  

  This QID checks for the file version of ntoskrnl.exe

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Please refer to the5013942
  5013943
  5013941
  5013945
  5014738
  5014746
  5014747
  5014741
  5014748
  5014742
  5014752
  5014743
  5014702
  5014710
  5014699
  5014697
  5014678
  5014692
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5013941
  KB5013942
  KB5013943
  KB5013945
  KB5014678
  KB5014692
  KB5014697
  KB5014699
  KB5014702
  KB5014710
  KB5014738
  KB5014741
  KB5014742
  KB5014743
  KB5014746
  KB5014747
  KB5014748
  KB5014752

• Microsoft Windows File Server Shadow Copy Agent Service (RVSS) Elevation of Privilege Vulnerability for June 2022

  Severity

  Serious 3

  Qualys ID

  91916

  Vendor Reference

  KB5014677, KB5014678, KB5014692, KB5014699, KB5014702, KB5014738, KB5014741, KB5014746, KB5014747

  CVE Reference

  CVE-2022-30154

  CVSS Scores

  Base 2.1 / Temporal 1.6

  Description

  Microsoft Windows Security Update - June 2022

  The KB Articles associated with the update:
  5014738
  5014746
  5014747
  5014741
  5014702
  5014699
  5014677
  5014678
  5014692
  

  This QID checks for the file version of ntoskrnl.exe

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Please refer to the 5014738
  5014746
  5014747
  5014741
  5014702
  5014699
  5014677
  5014678
  5014692
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  5014677
  5014678
  5014692
  5014699
  5014702
  5014738
  5014741
  5014746
  5014747

• Microsoft Windows Security Update for Memory Mapped I/O (MMIO) Stale Data Vulnerabilities (ADV220002)

  Severity

  Serious 3

  Qualys ID

  91917

  Vendor Reference

  ADV220002, KB5014678, KB5014692, KB5014697, KB5014699, KB5014702, KB5014710, KB5014738, KB5014741, KB5014742, KB5014743, KB5014746, KB5014747, KB5014748, KB5014752

  CVE Reference

  CVE-2022-21123, CVE-2022-21125, CVE-2022-21127, CVE-2022-21166

  CVSS Scores

  Base 2.1 / Temporal 1.6

  Description

  Microsoft has released software updates to help mitigate below vulnerabilities. To get all available protections, firmware (microcode) and software updates are required

  CVE-2022-21123 - Shared Buffer Data Read
  CVE-2022-21125 - Shared Buffer Data Sampling
  CVE-2022-21127 - Special Register Buffer Data Sampling Update
  CVE-2022-21166 - Device Register Partial Write

  QID Detection Logic (Authenticated):
  Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows 10 21H2, Windows 11, Windows Server 2019, Windows 2019 Core, Windows Server 2022

  
  The KB Articles associated with the update:
  5014738
  5014746
  5014747
  5014741
  5014748
  5014742
  5014752
  5014743
  5014702
  5014710
  5014699
  5014697
  5014678
  5014692
  

  This QID checks for the file version of ntoskrnl.exe This QID will check if the running processor is a Intel Processor by looking up the registry key "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor{DESCRIPTION}" value "VendorIdentifier".
  

  Consequence

  Successfully exploited these vulnerabilities may lead to information disclosure and impact confidentiality

  Solution

  Customers are advised to refer to ADV220002 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5014678
  KB5014692
  KB5014697
  KB5014699
  KB5014702
  KB5014710
  KB5014738
  KB5014741
  KB5014742
  KB5014743
  KB5014746
  KB5014747
  KB5014748
  KB5014752

• Microsoft Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability for June 2022

  Severity

  Serious 3

  Qualys ID

  91918

  Vendor Reference

  CVE-2022-30131

  CVE Reference

  CVE-2022-30131

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  A privilege escalation vulnerability exists in Windows Container Isolation FS Filter Driver

  The KB Articles associated with the update are:
  KB5014678
  KB5014692
  KB5014699
  KB5014702

  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of wcifs.sys.

  Consequence

  Successful exploitation of the vulnerability may result in escalation of privileges.

  Solution

  Please refer to the CVE-2022-30131 for more information pertaining to these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5014678
  KB5014692
  KB5014699
  KB5014702

• Microsoft Windows Codecs Library HEVC Video and AV1 Extensions Remote Code Execution (RCE) Vulnerability for June 2022

  Severity

  Critical 4

  Qualys ID

  91919

  Vendor Reference

  CVE-2022-22018, CVE-2022-29111, CVE-2022-29119, CVE-2022-30167, CVE-2022-30188, CVE-2022-30193

  CVE Reference

  CVE-2022-22018, CVE-2022-29111, CVE-2022-29119, CVE-2022-30167, CVE-2022-30188, CVE-2022-30193

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory.

  Affected Product:
  "HEVC from Device Manufacturer" media codec before version 2.0.51121.0
  "AV1 from Device Manufacturer" media codec before version 1.1.51091.0
  QID detection Logic:
  The gets the version of HEVCVideoExtension and AV1VideoExtension by querying wmi class Win32_InstalledStoreProgram.

  Consequence

  An attacker who successfully exploited this vulnerability can compromise confidentiality, integrity and availability of the system

  Solution

  Users are advised to check CVE-2022-30188, CVE-2022-30167, CVE-2022-29119, CVE-2022-29111 and CVE-2022-22018, CVE-2022-30193 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2022-22018
  CVE-2022-29111
  CVE-2022-29119
  CVE-2022-30167
  CVE-2022-30188
  CVE-2022-30193

• Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution (RCE) Vulnerability (Follina)

  Severity

  Critical 4

  Qualys ID

  91909

  Vendor Reference

  CVE-2022-30190

  CVE Reference

  CVE-2022-30190

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word.

  The KB Articles associated with the update:
  5014738
  5014746
  5014747
  5014741
  5014748
  5014742
  5014702
  5014710
  5014699
  5014697
  5014678
  5014692
  QID Detection Logic (Authenticated):
  This QID checks that the patch has been successfully applied by verifying the file version of msdt.exe.

  Consequence

  An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user's rights.

  Solution

  Please refer to the5014738
  5014746
  5014747
  5014741
  5014748
  5014742
  5014702
  5014710
  5014699
  5014697
  5014678
  5014692
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  5014678
  5014692
  5014697
  5014699
  5014702
  5014710
  5014738
  5014741
  5014742
  5014746
  5014747
  5014748

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.