Microsoft Patch Tuesday October 2022: Fixes 84 vulnerabilities

Microsoft released its October 2022 Patch Tuesday bringing a series of fixes for 84 vulnerabilities. One of these vulnerabilities has already been used in attacks by cybercriminals.

Thirteen of the 84 vulnerabilities fixed are classified as “Critical,” as they allow for the acquisition of additional privileges on vulnerable systems, spoofing, or remote code execution.

See also: IcedID malware: Hackers test new distribution methods

In the list below, you can see in detail the type of vulnerabilities fixed with the October Patch Tuesday and the number per category:

• 39 vulnerabilities that allow for elevation of privilege
• 20 vulnerabilities that allow remote code execution
• 11 vulnerabilities that allow information disclosure
• 8 Vulnerabilities for Denial of Service attacks
• 4 Spoofing vulnerabilities
• 2 vulnerabilities that bypass security solutions

The above vulnerabilities do not include the twelve vulnerabilities that were fixed in Microsoft Edge on October 3.

Microsoft Patch Tuesday: Two zero-day vulnerabilities

With October's Patch Tuesday, Microsoft is also patching two zero-day vulnerabilities. One is actively being used in attacks.

Microsoft classifies a vulnerability as a zero-day if it has been publicly disclosed or actively exploited before an official patch is released.

See also: Fortinet: Critical vulnerability used in attacks

The zero-day vulnerability used in attacks is tracked as “CVE-2022-41033 – Windows COM+ Event Service System Elevation of Privilege Vulnerability.” This vulnerability has a CVSSv3.1 score of 7.8/10.

Microsoft has not disclosed how the vulnerability is exploited or whether it is being exploited in targeted or more widespread attacks. However, it has said that the complexity of the attack is low. Successful exploitation of the vulnerability could allow an attacker to gain SYSTEM privileges, without requiring user interaction.

The second zero-day vulnerability is tracked as “CVE-2022-41043 – Microsoft Office Information Disclosure Vulnerability.” Microsoft says that attackers could use this vulnerability to gain access to users’ authentication tokens.

Two zero-day vulnerabilities in Microsoft Exchange not fixed

Unfortunately, Microsoft has not released security updates for two zero-day vulnerabilities that are actively being exploited and tracked as CVE-2022-41040 and CVE-2022-41082 (also known as ProxyNotShell). These two vulnerabilities are not fixed in the October Microsoft Patch Tuesday.

See also: Caffeine: Allows phishing attacks in Microsoft 365

These bugs were discovered in late September by Vietnamese cybersecurity firm GTSC, which first detected and reported the attacks. Microsoft was notified of the vulnerabilities through Trend Micro's Zero Day Initiative.

However, these vulnerabilities are not fixed with the new Patch Tuesday.

Microsoft Patch Tuesday October 2022: All vulnerabilities fixed

In the table below you can see all the vulnerabilities fixed by this month's patch.

Source: www.bleepingcomputer.com