Wrangling the May 2022 Patch Tuesday
Microsoft recently released security updates for over 70 vulnerabilities, including 3 zero-days and 7 critical vulnerabilities that affect a wide-range of their products and services. The list of patches covers an actively exploited zero-day vulnerability in the Windows Local Security Authority (LSA), as well as vulnerabilities in Kerberos, NFS, and LDAP protocols.
CVE-2022-26931 is a critical Kerberos vulnerability that provides an attacker with privilege elevation if successfully exploited.
CVE-2022-26937 is a critical NFS vulnerability included in the list of fixes. This vulnerability could allow an unauthenticated attacker to execute arbitrary code if successfully exploited over the network. Microsoft recommends disabling NFSV2 and NFSV3 as a means of exploit mitigation using the following PowerShell command. NFSv4.1, is not vulnerable:
powershell PS C:\Set-NfsServerConfiguration -EnableNFSV2 $false -EnableNFSV3 $false
Although most of the LDAP vulnerabilities affect all versions of Windows, CVE-2022-29131 an authenticated attacker can exploit the vulnerability over the network on a domain controller running Windows Server 2019, Windows 10, Windows 11 (x64/arm64), or Windows Server 2022.
CVE-2022-22012 and CVE-2022-29130 are listed as important remote code execution (RCE) vulnerabilities that also affect domain controllers, specifically LDAP. Although, according to the CVSS score for both vulnerabilities, they are deemed critical. An unauthenticated attacker could send a specially crafted request to a vulnerable server that would allow the attacker to remotely execute code within the SYSTEM account context. According to Microsoft, this vulnerability can only be exploited if the
MaxReceiveBuffer LDAP policy is set to a value higher than the default value (10,485,760); otherwise, the system is not vulnerable.
CVE-2022-29139 is also listed as important and it differs from the other LDAP vulnerabilities in that it flips the RCE on its head. If an LDAP client connects to a malicious LDAP server from a Windows host, the malicious server could allow an attacker to remotely execute code within the LDAP client.
_asset.protocol:kerberos and protocol:kerberos and kerberos.errorCode:68 and os:windows
_asset.protocol:nfs and protocol:nfs and os:windows
_asset.protocol:ldap and protocol:ldap and (has:"ldap.isSynchronized" or has:"ldap.domainControllerFunctionality") and type:server and os:windows
Free Rumble trial
Find all your Windows NFS, Kerberos, and domain controller assets.Start your free trial
May 5, 2022
Finding F5 BIG-IP instances
Technology vendor F5 recently published information on over 40 vulnerabilities, mostly affecting their BIG-IP line of products. While these vulnerabilities include a mix of types and severities, a particular authentication bypass vulnerability that can affect all BIG-IP …Read More
April 29, 2022
Finding Netatalk instances
A critical vulnerability in the Netatalk open source file server software was found in some popular network attached storage (NAS) devices. Netatalk provides services for the deprecated AFP (Apple Filing Protocol, formerly known as Appletalk Filing Protocol), and runs on a …Read More
March 30, 2022
Finding Kaspersky AV on your Windows endpoints
Late last week, the U.S. Federal Communications Commission announced it had added Russian-based Kaspersky Lab to its Covered List, maintained by the FCC to identify “entities that pose an unacceptable risk to U.S. national security.” This follows a 2017 action by the U.S. …Read More