Patch Tuesday January 2022 – Wormable Bug in Windows and a Critical Bug in Exchange Server Get Fixes

Microsoft patches a wormable bug in http.sys in Windows and Windows Server. There are also fixes for three remote code execution vulnerabilities in Exchange Server. And Adobe releases fixes for 26 flaws in Acrobat and Reader. So, let’s get started!

Windows and Windows Server

This month there are fixes for six zero-days in Windows and Windows Server but none of them are known to exploited by attackers in the wild at the time of release, although that’s likely to change naturally. Two of the zero-days, CVE-2021-36976 and CVE-2022-21874, are remote code execution (RCE) flaws. And CVE-2022-21836 is a certificate spoofing bug, which already has publicly available proof of concept code.

Wormable flaw in http.sys

But more concerning than the zero-days listed above is a wormable flaw in http.sys. CVE-2022-21907 could let an attacker execute code on an affected device using specially crafted network packets using the HTTP protocol. It doesn’t require any user interaction or special rights. Check your servers get patched first and then client devices. Microsoft says: “In Windows Server 2019 and Windows 10 version 1809, the HTTP Trailer Support feature that contains the vulnerability is not active by default.”

Devices are vulnerable if the following registry key is present:

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesHTTPParameters

"EnableTrailerSupport"=dword:00000001

Active Directory elevation of privilege flaw

CVE-2022-21857 is a bug that could let an attacker elevate rights across an Active Directory trust boundary under specific conditions. An attacker would require some access already to Active Directory. Microsoft has rated the bug Critical.

Exchange Server

Following on from the Exchange Server Y2K22 bug earlier this month, Microsoft has released patches for three RCE bugs, one of which is Critical (CVE-2022-21846). To be exploited, all the flaws would require internal network access.

Microsoft Office

CVE-2022-21840 is a Critical RCE bug that affects multiple versions of Microsoft Office. Unfortunately, there is no patch currently available for Office 2019 for Mac and Microsoft Office LTSC for Mac 2021. An attacker could get a user to open a specially crafted file, delivering it by email or a malicious website, to compromise a device.

Table 1 – Microsoft Patch Tuesday updates, January 2021

Adobe

Adobe released 5 patches fixing 41 CVEs in January. The bugs affect Acrobat and Reader, Illustrator, Adobe Bridge, InCopy, and InDesign. And no surprises that the Acrobat and Reader patch fixes a massive 26 bugs in the software, including an RCE an attacker could exploit if the user opens a specially crafted PDF document.

But none the flaws patched by Adobe this month are known to be actively exploited in the wild at the time of release, but again that will likely change.

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary as hackers start to work out how to weaponize newly reported vulnerabilities.

Best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.

If you have any problems with this month’s patches, please let us know in the comments below. Other readers might be able to share their experiences in how to roll back problematic updates or mitigate issues caused by patches that are important to have in place.

But that is it for another month and happy patching!