Microsoft Super Patch Tuesday

Yesterday Microsoft released 145 patches to resolve vulnerabilities in its software including 10 that are labelled “Critical”.

This unfortunately does not include the PrintNightmare zero-day vulnerability that allows attackers to gain administrative privileges on Windows devices which was accidentally made public. Ransomware gangs, like Vice Society and Conti, have used the bug in order to gain privileges on compromised devices.

Organisations are urged to Patch these issues as soon as possible.

For Those Interested

Highlights

CVE-2022-24475 – Elevation of Privilege Vulnerability

An undisclosed defect in Microsoft’s Chromium-based Edge might allow a threat actor to remotely obtain higher privileges. The CVE, which received a Max Severity score of Important, has been fixed. CVE-2022-24475 affected machines running Chromium Version 100.0.4896.60 or lower.

CVE-2022-24523 – Spoofing Vulnerability

A defective Microsoft Edge component might allow a threat actor to run arbitrary code or obtain higher privileges by passing along forged packages to the user. The issue was labelled as fixed.

CVE-2022-26891 – Elevation of Privilege Vulnerability

A bugged component can be leveraged by a threat actor in order to obtain higher local machine privileges. The issue was fixed.

Patching can all be managed as part of your Managed Service Contract with IT Ambulance Ltd.

http://www.itambulance.co.uk