January 2022 Patch Tuesday: Microsoft Fixes 126 Flaws, Nine Critical, and Adobe 41

Microsoft's first Patch Tuesday release of 2022 fixed 126 vulnerabilities, nine of them rated critical, according to an analysis by Bharat Jogi, director of vulnerability and threat research at Qualys. At the time he wrote it, none of the 126 were known to be under active exploitation. The flaws span remote code execution (RCE), privilege escalation, spoofing and denial of service (DoS).

The critical Microsoft flaws

CVE-2022-21907: HTTP Protocol Stack remote code execution

Scored 9.8 out of 10 on CVSSv3.1, this bug affects Windows Server machines set up as web servers. An attacker who needs no credentials could exploit it by sending a specially crafted packet to a vulnerable server that uses the HTTP Protocol Stack to handle packets. The flaw is known to be wormable. Microsoft's exploitability assessment: Exploitation More Likely.

CVE-2022-21849: Windows IKE Extension remote code execution

Also rated 9.8 out of 10, this one affects systems running Internet Key Exchange (IKE) version 2. Few details were available, but Jogi notes that a remote, unauthenticated attacker could set off multiple vulnerabilities on a Windows system where the IPSec service is running. Assessment: Exploitation Less Likely.

CVE-2022-21846: Microsoft Exchange Server remote code execution

The National Security Agency (NSA) found this flaw and reported it to Microsoft. It scores 9.0 out of 10. At the protocol level, an attack is restricted to a logically adjacent topology, so it cannot be launched straight across the Internet and needs some specific connection to the target. Examples include sharing the same physical network (Bluetooth or IEEE 802.11, say), the same logical network (such as a local IP subnet), or operating from inside a secure or otherwise restricted administrative domain (for instance MPLS, or a secure VPN into an administrative network zone). Jogi points out that this is typical of attacks that depend on a man-in-the-middle position or on first gaining a foothold in another environment. Assessment: Exploitation More Likely.

CVE-2022-21837: Microsoft SharePoint Server remote code execution

With a score of 8.3 out of 10, this vulnerability lets an attacker reach the domain and potentially run code remotely on the SharePoint server, raising their privileges to SharePoint administrator. Assessment: Exploitation Less Likely.

CVE-2022-21840: Microsoft Office remote code execution

Rated 8.8 out of 10, this bug can be exploited only if a user opens a specially crafted file. By email, an attacker could send the victim such a file and talk them into opening it. On the web, an attacker could host a site, or use a compromised site that accepts or hosts content from users, carrying a file built to exploit the flaw. Assessment: Exploitation Less Likely.

Adobe's January updates

Adobe shipped fixes for 41 CVEs across Adobe Acrobat and Reader, Bridge, Illustrator, InCopy and InDesign, 22 of which it classes as critical. Its updates for Acrobat and Reader on Windows and macOS cover critical, important and moderate vulnerabilities. If exploited, the flaws could allow arbitrary code execution, memory leaks, application denial of service, bypassing of security features and privilege escalation.

Finding and patching affected hosts in Qualys VMDR

Jogi explains that Qualys VMDR picks up new Patch Tuesday vulnerabilities automatically through continuous updates to its Knowledge Base (KB). Hosts affected by this month's flaws can be listed with a QQL query covering QIDs 50118, 91851, 91852, 91853, 91854, 110398, 110399 and 376232, in the form vulnerabilities.vulnerability:(q qid:`50118` OR qid:`91851` OR qid:`91852` OR qid:`91853` OR qid:`91854` OR qid:`110398` OR qid:`110399` OR qid:`376232`).

For remediation, VMDR deploys the most relevant patch for each technology version on Windows hosts. Administrators pick the relevant QIDs in the Patch Catalogue, filter for "Missing" patches and deploy everything applicable at once. The same set of QIDs, queried without the vulnerabilities prefix, returns the missing patches for this Patch Tuesday.

Updated Patch Tuesday dashboards are available in Qualys's Dashboard Toolbox under the 2021 Patch Tuesday Dashboard.