Three zero-days addressed in Microsoft’s May 2022 Patch Tuesday

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here

Microsoft addressed 74 vulnerabilities in their May 2022 Patch Tuesday Security Update. Three of them are zero-days, and one is being exploited in the wild.

The LSA Spoofing vulnerability (CVE-2022-26925) is actively exploited in the wild and allows an unauthenticated attacker to call a method on the LSARPC interface and compel the domain controller to use NTLM to authenticate the attacker. Successful exploitation of the second zero-day vulnerability(CVE-2022-22713) requires an attacker to win a race condition. The third zero-day vulnerability affects the Microsoft Integration Runtime services in the Magnitude Simba Amazon Redshift ODBC Driver.

Organizations have advised the patch of all these vulnerabilities as soon as possible to avoid exploitation.

Potential MITRE ATT&CK TTPs are:

TA0042: Resource Development

T1588: Obtain Capabilities

T1588.006: Obtain Capabilities: Vulnerabilities

TA0001: Initial Access

T1190: Exploit Public-Facing Application

TA0006: Credential Access

T1557: Adversary-in-the-Middle

Vulnerability Details

Patch Links

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26925

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-22713

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-29972

References

https://msrc.microsoft.com/update-guide/releaseNote/2022-May