Microsoft Patch Tuesday – March 2022

Patch Tuesday is once again upon us. The March 2022 edition of Patch Tuesday brings us 72 fixes, with 3 rated as critical. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the March 2022 Patch Tuesday Audit Report

Exchange Is Back on the Menu

Microsoft Exchange has been a recurring topic the last months with continuous problems and fixes being released. This month’s patch Tuesday includes a critical fix for Microsoft Exchange for CVE-2022-23277. A remote code execution vulnerability with a CVSS base score of 8.8. According to Microsoft’s exploitability assessment, this vulnerability’s exploitability is more likely, so quick pathing is recommended.

To exploit the vulnerability, the attacker must be authenticated, additionally, Microsoft lists that “As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server’s account through a network call“.

In addition to the RCE, a spoofing vulnerability has also been disclosed. CVE-2022-24463 with a CVSS base score of 6.5 can lead to file content being exposed. Similar to the RCE, the attacker must be authenticated. To get file content the attacker would have to create a specially crafted network call to the target Exchange Server that causes the parsing of an http request made to an attacker-controlled server.

Video Codec RCE Vulnerabilities

Two video codec extensions offered through the Microsoft Store also contain remote code execution vulnerabilities. The VP9 video extension contains CVE-2022-24501 and the HEVC video extension contains CVE-2022-22006, both with a CVSS base score of 7.8.

The vulnerabilities can be exploited by convincing the user to open a specifically crafted file. Since these vulnerabilities lie in Microsoft Store apps, you’ll have to ensure that you’re not using or have the latest version with a fix installed. For VP9, this means version 1.0.42791.0. For HVEC, if the app is manufacturer pre-installed version 1.0.50361.0 or if you’ve purchased the app, version 1.0.50362.0.

Talking about Microsoft Store apps, Lansweeper 9.3, includes Microsoft Store app scanning, so you’ll be able to find exactly which devices have these apps installed and which version.

Run the Patch Tuesday March 2022 Audit Report

To help manage your update progress, we’ve created the Patch Tuesday Audit Report that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see at a glance which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured

Patch Tuesday March 2022 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" indicates required fields

Email*

This field is hidden when viewing the form

EmailType

This field is hidden when viewing the form

IM – Conv Page – Processing

This field is hidden when viewing the form

IM – UTM_Campaign FC – Processing

This field is hidden when viewing the form

IM – UTM_Campaign LC – Processing

This field is hidden when viewing the form

IM – UTM_Content FC – Processing

This field is hidden when viewing the form

IM – UTM_Content LC – Processing

This field is hidden when viewing the form

IM – UTM_Medium FC – Processing

This field is hidden when viewing the form

IM – UTM_Medium LC – Processing

This field is hidden when viewing the form

IM – UTM_Source FC – Processing

This field is hidden when viewing the form

IM – UTM_Source LC – Processing

This field is hidden when viewing the form

IM – UTM_Term FC – Processing

This field is hidden when viewing the form

IM – UTM_Term LC – Processing

This field is hidden when viewing the form

gclid

This field is hidden when viewing the form

msclkid

Email

This field is for validation purposes and should be left unchanged.

Count Me In Submit