Microsoft Patch Tuesday – January 2022

Patch Tuesday is once again upon us. The January 2022 edition of Patch Tuesday brings us 98 fixes, 9 of which are rated as critical. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the January 2022 Patch Tuesday Audit Report

HTTP Protocol Stack RCE

The most severe vulnerability fixed this month is a remote code execution vulnerability in the HTTP protocol stack, CVE-2022-21907. By sending a specially crafted packet, an attacker can target a vulnerable server using the HTTP protocol stack (http.sys) to process packets which can allow for remote code execution on the targetted system. Patching is the best solution and with a CVSS base score of 9.8, it is best you patch this one as soon as possible. Microsoft also mentions that this vulnerability is wormable!

Windows Server 2019 and Windows 10 version 1809 aren’t vulnerable by default to this one, but if the HTTP Trailer Support feature has been enabled, even those versions are vulnerable. Microsoft recommends checking the following registry key if you want to double-check if your Server 2019 and Windows 10 version 1809 systems are affected:

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesHTTPParameters
“EnableTrailerSupport”=dword:00000001

To perform this check across your entire IT environment you can also use the registry key audit. This will let you audit all of your computers at once and get an overview of machines where the registry key has been found.

Microsoft Exchange Server RCE

Microsoft Exchange keeps on giving, after the Y2K22 bug earlier this month, a new RCE has been fixed with a CVSS base score of 9, CVE-2022-21846. Luckily Microsoft lists that this vulnerability cannot be exploited via the internet. It can only be exploited on a logically adjacent topology. Microsoft provided some examples of what this could look like:

“Good examples would include the same shared physical network (such as Bluetooth or IEEE 802.11), logical network (local IP subnet), or from within a secure or otherwise limited administrative domain (MPLS, secure VPN to an administrative network zone). This is common to many attacks that require man-in-the-middle type setups or that rely on initially gaining a foothold in another environment.”

Microsoft Office RCE

The last of the big critical vulnerabilities is related to Microsoft Office. CVE-2022-21840 has a CVSS score of 8.8. Similar to previous vulnerabilities in Office, luckily the preview pane isn’t vulnerable, so at least there is some protection. The vulnerability requires users to either open a malicious file or click on a link that refers to a hosted file. Like many other vulnerabilities, ensuring your users have adequate training on safe web usage should prevent exploitation.

Run the Patch Tuesday January 2022 Audit Report

To help manage your update progress, we’ve created the Patch Tuesday Audit Report that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see at a glance which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

Patch Tuesday January 2022 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" indicates required fields

Email*

Hidden

EmailType

Hidden

IM – Conv Page – Processing

Hidden

IM – UTM_Campaign FC – Processing

Hidden

IM – UTM_Campaign LC – Processing

Hidden

IM – UTM_Content FC – Processing

Hidden

IM – UTM_Content LC – Processing

Hidden

IM – UTM_Medium FC – Processing

Hidden

IM – UTM_Medium LC – Processing

Hidden

IM – UTM_Source FC – Processing

Hidden

IM – UTM_Source LC – Processing

Hidden

IM – UTM_Term FC – Processing

Hidden

IM – UTM_Term LC – Processing

Hidden

gclid

Hidden

msclkid

Email

This field is for validation purposes and should be left unchanged.

Count Me In Submit