February 2022 Patch Tuesday: Microsoft Fixes 70 Flaws With None Critical, Adobe Patches 17 With Five Critical

Microsoft's February 2022 Patch Tuesday was a quieter cycle than usual, according to Bharat Jogi, director of vulnerability and threat research at Qualys. The company shipped fixes for 70 vulnerabilities, and not one of them carried a critical rating. Several did receive a High rating, meaning a CVSSv3.1 score somewhere between 7.0 and 8.9. At the time Jogi wrote his analysis, there was no evidence that any of the month's flaws were being exploited in the wild.

The release spans a wide set of bug classes: remote code execution (RCE), privilege escalation, spoofing, information disclosure, feature bypass and denial of service (DoS). It also closes CVE-2022-21989, a vulnerability that had previously been a zero-day.

Products covered by the advisory include Azure Data Explorer, the Kestrel Web Server, the Chromium-based Microsoft Edge, the Windows Codecs Library, Microsoft Dynamics and Dynamics GP, Microsoft Office and its components, Windows Hyper-V Server, SQL Server, Visual Studio Code and Microsoft Teams.

The four Microsoft fixes Jogi singles out

CVE-2022-21984: Windows DNS Server RCE

Scored 8.8 out of 10 on CVSSv3.1, this flaw in Microsoft's DNS server allows remote code execution. Only servers with dynamic updates switched on are exposed, but Jogi points out that this setting is fairly common. Where it is enabled, an attacker could take over DNS completely and run code with elevated privileges. Microsoft rates exploitation as less likely.

CVE-2022-21989: Windows Kernel elevation of privilege

This is the former zero-day, with a CVSSv3.1 score of 7.8 out of 10. An attack can be launched from a low-privilege AppContainer. If it succeeds, the attacker gains higher privileges and can run code or reach resources at an integrity level above what the AppContainer execution environment normally permits. Microsoft considers exploitation more likely.

CVE-2022-22003: Microsoft Office Graphics RCE

Also scored 7.8 out of 10, this remote code execution bug sits in Microsoft Office Graphics. It cannot be exploited without user involvement: the victim has to be tricked into opening a malicious file. Microsoft's assessment is that exploitation is less likely.

CVE-2022-22005: Microsoft SharePoint Server RCE

The SharePoint Server flaw scores 8.8 out of 10. To use it, an attacker needs to be authenticated and must hold permission to create pages on SharePoint. Microsoft rates exploitation as more likely.

Adobe: 17 CVEs, five of them critical

Adobe's February updates deal with 17 CVEs across Premiere Rush, Illustrator, Photoshop, After Effects and the Creative Cloud Desktop Application. Five of the 17 are rated critical.

The security updates for Illustrator, Photoshop and After Effects cover both Windows and macOS, and fix a mix of critical, important and moderate issues. If exploited, these bugs could result in an application denial of service, arbitrary code execution, privilege escalation or memory leaks.

Finding and patching affected hosts with Qualys VMDR

Jogi explains that Qualys VMDR picks up new Patch Tuesday vulnerabilities on its own, because its Knowledge Base (KB) is updated continuously. Hosts affected by this month's release can be listed with a QQL query on vulnerabilities.vulnerability that matches any of these QIDs: 91857, 91858, 91859, 91860, 91861, 91863, 91866, 110400, 110401, 110402 and 376382.

For remediation, VMDR deploys patches to Windows hosts matched to each technology and version. Administrators pick the relevant QIDs in the Patch Catalogue and filter for "Missing" patches, which lets them find and push out every applicable patch in a single pass. The same set of QIDs, queried in QQL, returns the missing patches for this Patch Tuesday.