Purpose of Work:

May's Patch Tuesday has arrived, and it's a relatively average one in terms of patch volume.  That said, there's a few publicly known vulnerabilities in the mix (one with with active exploitation detected), so we'll be proceeding on schedule.  Initial reports of post-patch experience are relatively normal.

Starting off the highlights this month, we have an LSA Spoofing vulnerability affecting all supported versions of Windows Server ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26925).  This one is detected as being in the wild, and the vulnerability's complexity is labelled 'high', and reading through it, that tracks.  The most dangerous use case of this seems to be that an attacker gets a domain controller to authenticate against a malicious host using unauthenticated LSARPC calls.  From there, they can use captured credentials to access anything in the domain.  We'll be applying this patch, and giving the guidance article linked in that CVE a thorough review for any additional practices we or fully managed clients should implement to make NTLM relaying itself much more difficult.

Second off, we have an elevation of privilege vulnerability leveraging Active directory certificate services, and affecting Windows Server 2012 / Windows 8 and up ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923 ).  This one has been publicly disclosed, and allows a user with delegation rights for any computer accounts the ability to issue themselves a certificate that would grant domain administrator rights.  We'll be applying this on our own domain controllers, and will evaluate which clients on an independent update schedule are most vulnerable to this, tommorow.

Third, we have another remote code execution vulnerability leveraging Windows NFS Server, and affecting all supported versions of windows ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26937 ).  We do not run NFS Server in our environment, but anybody who does (likely somebody with a tightly integrated windows/linux environment), will want to read up on this vulnerability, since it's wormable. 

Fourth up, there's an elevation of privilege vulnerability affecting all supported versions of Exchange Server ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21978).  This one requires administrator roles and rights on the exchange server (and the host it's on), but can potentially elevate a user's rights to the domain administrator level.  Naturally, we'll be patching all managed exchange servers tonight.


There's more, as usual, but those are the ones of particular note.


Impact of Work:


All affected hosts that are 2012 and up will be rebooted automatically / ASAP to propagate fixes, starting at 10:15PM, with some exceptions.

Internal systems on Windows 2012 and up (such as the management portal) may be temporarily impacted in the time it takes to reboot them.  Mail delivery to our helpdesk may be temporarily halted while our mail servers are updated as part of this patch cycle.  If you receive a delivery failure, you can still reach us by logging directly into the helpdesk and submitting a ticket directly via the portal, or calling us at 303-414-6910 x2, for emergencies.  


Hypervisors in a failover cluster will have rolling reboots done, in order to eliminate VPS downtime on said clusters.  Hypervisors not in a failover cluster will either be updated overnight, or have their updates scheduled, depending on customer policy / VM density.

Hypervisors in DR scenarios will be updated one hour early, as they are not running active workloads.

Any hosts where updates are managed directly by the customer (or an approval process is required for zero-day updates) will not be impacted; the controlling organizations will be notified separately.


Please contact us with any questions / comments / concerns.

Purpose of Work:

April's Patch Tuesday is here, and while there's definitely some vulnerabilities of concern being addressed in this drop, only one is being actively exploited.

The patch volume is average, for this time of year (if a little high in critical and important security updates), and no widespread issues have been reported with the patches.

A few of the particularly concerning ones:

First off, we have a system-level remote code execution vulnerability that leverages the Remote Procedure Call Runtime, and affects seemingly all supported versions of windows ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809 ).  This one is particularly concerning, because it doesn't require authentication, and any code executed would automatically execute in a system context, making it a wormable vulnerability that could very quickly compromise an unpatched network of windows hosts if it were exploited.  This one is not yet in the wild, so we'll be following our usual patching schedule to deal with it.  If you are unable to patch this on on a self-managed environment, our recommendation is you block port 445 from untrusted hosts.

Second on the shortlist is a local elevation of privilege vulnerability that leverages the "Common Log File System Driver", also affecting seemingly all support versions of windows ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521 ).  This requires local login with a low-privilege user, so it's only dangerous when paired with an RCE exploit.  However, it has been detected as actively exploited, so this is one self-managed environments will want to ensure is patched ASAP, as it could be the difference between a compromised website and a ransomware situation.

Third up, we have several system-level local code execution vulnerabilities that leverage the Hyper-V service, on Windows 2012+ between the three of them ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24537 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23257 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22008 ).  These vulnerabilities appear capable of jumping the guest/HV divide, requiring interaction by a low-privileged user on the guest, and a race condition to pass ( introducing an element of random chance) to exploit.  However, with enough tries, this could pose a hazard to Hyper-V environments very easily.  It is recommended that all Hyper-V nodes are updated ASAP; we'll be doing that for those we control scheduling for.

Fourth on the list two seemingly related RCE vulnerabilities, leveraging SMB Server and SMB Client on all supported versions of windows ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24541 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500 ).  Both vulnerabilities appear to require low-privilege user interaction with a malicious SMB server to compromise either component, so this is one that's likely to be used in phishing attacks and malicious websites.

Fifth, there's a publicly disclosed elevation of privilege vulnerability leveraging the User Profile Service, and affecting all supported versions of windows.  Despite being publicly disclosed, Microsoft reports no use of an exploit detected in the wild yet... though it's only a matter of time.  The attack complexity for this one is high, requiring the attacker to win a race condition (more or less, a dice roll influenced by the order of events in a target responding to the exploit).  However, a determined attacker with a non-privileged user foothold could certainly use this to compromise a host on a system level with time.

Impact of Work:


All affected hosts that are 2012 and up will be rebooted automatically / ASAP to propagate fixes, starting at 9:30PM, with some exceptions.

Internal systems on Windows 2012 and up (such as the management portal) may be temporarily impacted in the time it takes to reboot them.  Mail delivery to our helpdesk may be temporarily halted while our mail servers are updated as part of this patch cycle.  If you receive a delivery failure, you can still reach us by logging directly into the helpdesk and submitting a ticket directly via the portal, or calling us at 303-414-6910 x2, for emergencies.  


Hypervisors in a failover cluster will have rolling reboots done, in order to eliminate VPS downtime on said clusters.  Hypervisors not in a failover cluster will either be updated overnight, or have their updates scheduled, depending on customer policy / VM density.

Hypervisors in DR scenarios will be updated one hour early, as they are not running active workloads.

Any hosts where updates are managed directly by the customer (or an approval process is required for zero-day updates) will not be impacted; the controlling organizations will be notified separately.


Please contact us with any questions / comments / concerns.