![]() The company disclosed an Exchange Server elevation-of-privilege vulnerability (CVE-2022-41040) and an Exchange Server remote-code execution vulnerability (CVE-2022-41082) - security researcher Kevin Beaumont dubbed the pair of CVEs as ProxyNotShell - and issued guidance to protect Microsoft Exchange Server 2013, Exchange Server 2016 and Exchange Server 2019. 29 blog by the Microsoft Security Response Center indicated the on-premises email platform was under attack. Other than its earlier mitigation instructions for two Exchange Server zero-days, Microsoft had no further relief for administrators who had to act quickly after a Sept. "While the public disclosure definitely points to a problem, a threat actor will not have a workable sample to start building off of right away." Exchange Server zero-days remain unpatched "While it was publicly disclosed, the code maturity is still listed as unproven, so there are no real samples of exploit code available," Goettl said. The Common Vulnerability Scoring System (CVSS) rating is relatively low at 3.3, which indicates the danger is minimal. Upon a successful exploit of this flaw, an attacker could retrieve user tokens or other sensitive information. This bug specifically targets Outlook for Mac, and Microsoft stipulated the preview pane was not an attack vector for the vulnerability. The public disclosure is a Microsoft Office information disclosure vulnerability (CVE-2022-41043) rated important for two products running on macOS: Microsoft Office 2019 for Mac and Microsoft Office LTSC for Mac 2021. Outlook for Mac public disclosure resolved People should be prioritizing this more urgently," said Chris Goettl, vice president of product management for security products at Ivanti, an IT asset and endpoint management company. "It's only rated important, but because it's been exploited in the wild, there's a higher risk associated with it. ![]() This zero-day affects every supported Windows OS, including Windows 7 and Windows Server 2008/R2 in the Extended Security Updates program, which should provide extra incentive for administrators to deploy the October Patch Tuesday fixes promptly. ![]() This bug does not require user interaction, and successfully exploiting the vulnerability gives the attacker system privileges. The Windows zero-day is an elevation-of-privilege vulnerability (CVE-2022-41033) in Windows COM+ Event System service that is rated important. Windows zero-day tops the patching priority list Thirteen of the October Patch Tuesday security updates were rated critical. In total, Microsoft addressed 89 unique CVEs this month with five of the security updates rereleased from August to address issues affecting Exchange Server functionality.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |