Security News > 2022 > June > Microsoft fixes under-attack Windows zero-day Follina
Microsoft claims to have finally fixed the Follina zero-day flaw in Windows as part of its June Patch Tuesday batch, which included security updates to address 55 vulnerabilities.
Criminals and snoops can abuse the remote code execution bug, tracked as CVE-2022-30190, by crafting a file, such as a Word document, so that when opened it calls out to the Microsoft Windows Support Diagnostic Tool, which is then exploited to run malicious code, such spyware and ransomware.
"The update for this vulnerability is in the June 2022 cumulative Windows Updates," Redmond said in today's Follina security update.
In addition to mitigating Follina, Microsoft plugged three critical RCE flaws and said none of them have been exploited.
"This could adversely affect your ecosystem and should only be used as a temporary mitigation," it cautioned, adding a bolded warning: "You should NOT apply this mitigation unless you have installed the May 2022 Windows security updates." These fix CVE-2022-26937, another critical vuln in NFS. The next critical RCE, CVE-2022-30163, is in the Windows Hyper-V hypervisor.
While CVE-2022-30147, a Windows Installer elevation of privilege vulnerability with a CVSS score of 7.8 doesn't rank as high, severity wise, as some of the others, "This kind of vulnerability is almost always seen during a cyber attack," Breen noted.
News URL
https://go.theregister.com/feed/www.theregister.com/2022/06/15/microsoft_patch_tuesday/
Related news
- Microsoft fixes actively exploited Windows Hyper-V zero-day flaws (source)
- Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks (source)
- Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks (source)
- New Windows Server 2012 zero-day gets free, unofficial patches (source)
- Microsoft says premature patch could make Windows Recall forget how to work (source)
- Japan warns of IO-Data zero-day router flaws exploited in attacks (source)
- Microsoft says having a TPM is "non-negotiable" for Windows 11 (source)
- New Windows zero-day exposes NTLM credentials, gets unofficial patch (source)
- Fully patched Cleo products under renewed 'zero-day-ish' mass attack (source)
- New Cleo zero-day RCE flaw exploited in data theft attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-06-15 | CVE-2022-30163 | Race Condition vulnerability in Microsoft products Windows Hyper-V Remote Code Execution Vulnerability | 0.0 |
| 2022-06-15 | CVE-2022-30147 | Unspecified vulnerability in Microsoft products Windows Installer Elevation of Privilege Vulnerability | 0.0 |
| 2022-06-01 | CVE-2022-30190 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Microsoft products A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. | 0.0 |
| 2022-05-10 | CVE-2022-26937 | Unspecified vulnerability in Microsoft products Windows Network File System Remote Code Execution Vulnerability | 0.0 |