Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Microsoft’s May 2022 Patch Tuesday Addresses 73 CVEs (CVE-2022-26925)

Microsoft addresses 73 CVEs in its May 2022 Patch Tuesday release, including two zero-day vulnerabilities, one of which was exploited in the wild.

  1. 6Critical
  2. 66Important
  3. 0Moderate
  4. 1Low

Update May 12: This blog has been updated to include information on an out-of-band advisory for CVE-2022-30138, which was patched as part of Patch Tuesday but was not publicized until today.

View Change Log

Microsoft patched 73 CVEs in its May 2022 Patch Tuesday release, with six rated as critical, 66 rated as important and one rated as low.

This month’s update includes patches for:

  • .NET and Visual Studio
  • Microsoft Exchange Server
  • Microsoft Graphics Component
  • Microsoft Local Security Authority Server (lsasrv)
  • Microsoft Office
  • Microsoft Office Excel
  • Microsoft Office SharePoint
  • Microsoft Windows ALPC
  • Remote Desktop Client
  • Role: Windows Fax Service
  • Role: Windows Hyper-V
  • Self-hosted Integration Runtime
  • Tablet Windows User Interface
  • Visual Studio
  • Visual Studio Code
  • Windows Active Directory
  • Windows Address Book
  • Windows Authentication Methods
  • Windows BitLocker
  • Windows Cluster Shared Volume (CSV)
  • Windows Failover Cluster Automation Server
  • Windows Kerberos
  • Windows Kernel
  • Windows LDAP - Lightweight Directory Access Protocol
  • Windows Media
  • Windows Network File System
  • Windows NTFS
  • Windows Point-to-Point Tunneling Protocol
  • Windows Print Spooler Components
  • Windows Push Notifications
  • Windows Remote Access Connection Manager
  • Windows Remote Desktop
  • Windows Remote Procedure Call Runtime
  • Windows Server Service
  • Windows Storage Spaces Controller
  • Windows WLAN Auto Config Service

Remote code execution (RCE) vulnerabilities accounted for 32.9% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 28.8%.

Important

CVE-2022-26925 | Windows LSA Spoofing Vulnerability

CVE-2022-26925 is a spoofing vulnerability in the Windows Local Security Authority (LSA) that received a CVSSv3 score of 8.1. However, when chained with a new technology LAN manager (NTLM) relay attack, the combined CVSSv3 score for the attack chain is 9.8. According to the advisory from Microsoft, it has been exploited in the wild as a zero-day. An unauthenticated attacker could coerce domain controllers to authenticate to an attacker-controller server using NTLM. Microsoft provides two pieces of documentation for further protecting systems against these attacks. Microsoft recommends that organizations prioritize patching domain controllers for this vulnerability.

This vulnerability is similar to CVE-2021-36942, which is part of the PetitPotam attack chain.

Critical

CVE-2022-26937 | Windows Network File System Remote Code Execution Vulnerability

CVE-2022-26937 is a RCE vulnerability impacting the Windows Network File System (NFS) which can be exploited by a remote, unauthenticated attacker using a specially crafted call to a NFS service to achieve code execution. Microsoft assigned a 9.8 CVSSv3 score and rated this as “Exploitation More Likely” according to Microsoft’s Exploitability Index. NFS version 4.1 is not impacted by this vulnerability and Microsoft provides the recommended workaround of disabling NFS versions 2 and 3 for those users who are not able to immediately apply the patch. However the workaround does warn that it may “adversely affect your ecosystem” and is only a temporary measure until patching can be completed.

Important

10 Remote Code Execution Vulnerabilities in Windows Lightweight Directory Access Protocol (LDAP)

This month Microsoft patched 10 vulnerabilities in Windows LDAP.

Two of the CVEs, CVE-2022-29130 and CVE-2022-22012 received CVSSv3 scores of 9.8 and the remainder of the flaws each were scored at 8.8. Microsoft has rated all of these vulnerabilities as “Exploitation Less Likely.” While both CVE-2022-29130 and CVE-2022-22012 received higher CVSS scores, both vulnerability descriptions provide the same caveat that the vulnerability only exists if the “MaxReceiveBuffer” LDAP policy is configured to a higher value than the default value (i.e. a higher maximum number of threads LDAP requests can contain per processor). A system with the default value for the policy would not be affected. With the exception of CVE-2022-29130, CVE-2022-22012 and CVE-2022-29139, the vulnerabilities each require authentication in order to exploit. Exploitation of CVE-2022-29139 requires an attacker to convince a vulnerable LDAP client machine to connect to a malicious LDAP server.

Important

CVE-2022-22713 | Windows Hyper-V Denial of Service Vulnerability

CVE-2022-22713 is a DoS vulnerability impacting Windows Hyper-V. According to Microsoft’s description, exploitation of the vulnerability requires an attacker to win a race condition giving it a high complexity rating and a CVSSv3 score of 5.6. While it’s extremely unlikely that this vulnerability will see exploitation in the wild, Microsoft does note that the vulnerability was publicly disclosed. It is credited to Joe Bialek on Microsoft Security Response Center’s Vulnerabilities and Mitigations Team.

Important

CVE-2022-21978 | Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-21978 is an EoP vulnerability in Exchange Server that received a CVSSv3 score of 8.2 and was rated “Exploitation Less Likely.” CVE-2022-21978 was discovered by Joonas Tuomisto of Fujitsu Finland. An attacker must already be authenticated to a vulnerable Exchange Server “as a member of a high privileged group” to exploit this vulnerability but could use it to elevate themselves to domain administrator access. While these prerequisites might make it less likely for attackers to adopt this vulnerability, Exchange Server vulnerabilities have been prime targets for attackers. Vulnerabilities that can give attackers domain administrator permissions are particularly valuable.

Important

CVE-2022-29132 and CVE-2022-29104 | Windows Print Spooler Elevation of Privilege Vulnerabilities

CVE-2022-29132 and CVE-2022-29104 are EoP vulnerabilities in Windows Print Spooler that received a CVSSv3 score of 7.8 and were rated “Exploitation More Likely.” CVE-2022-29132 was disclosed by g0st1 and CVE-2022-29104 by Oliver Lyak from the Institut for Cyber Risk on behalf of Trend Micro Zero Day Initiative. These are just the latest in a long line of EoP vulnerabilities Microsoft has addressed in Print Spooler over the last year, several of which have been exploited in attacks.

In addition to the two EoP vulnerabilities, Microsoft also patched two information disclosure vulnerabilities in Print Spooler this month: CVE-2022-29140 and CVE-2022-29114.

Important

CVE-2022-30138 | Windows Print Spooler Elevation of Privilege Vulnerability

CVE-2022-30138 is another EoP vulnerability in the Windows Print Spooler. This vulnerability was patched as part of Patch Tuesday on May 10. However, information about this flaw was not made public until May 12. Similar to CVE-2022-29132 and CVE-2022-29104, it received a CVSSv3 score of 7.8. However, Microsoft rates this vulnerability as “Exploitation Less Likely” compared to the previous two EoP flaws in Print Spooler. While the publication of this CVE was made on May 12, customers that have already applied the Patch Tuesday updates do not need to take any additional steps to address this vulnerability.

Windows 10 End of Servicing

Today, Windows 10 version 20H2 has reached the end of servicing and will no longer receive security updates. Users are urged to update to more recent versions to ensure they continue receiving important security updates.

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains May 2022.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s May 2022 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Change Log

Update May 12:This blog has been updated to include information on an out-of-band advisory for CVE-2022-30138, which was patched as part of Patch Tuesday but was not publicized until today.

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training