Security News
Patch Tuesday Microsoft fixed 98 security flaws in its first Patch Tuesday of 2023 including one that's already been exploited and another listed as publicly known. Microsoft explains how to trigger this upgrade in the alert as Childs notes: "Situations like this are why people who scream 'Just patch it!' show they have never actually had to patch an enterprise in the real world."
The first is a Microsoft Exchange elevation of privileges bug tracked as CVE-2022-41080 that can be chained with the CVE-2022-41082 ProxyNotShell bug to gain remote code execution. Texas-based cloud computing provider Rackspace confirmed one week ago that the Play ransomware gang exploited it as a zero-day to bypass Microsoft's ProxyNotShell URL rewrite mitigations and escalate permissions on compromised Exchange servers.
Today is Microsoft's January 2023 Patch Tuesday, and with it comes fixes for an actively exploited zero-day vulnerability and a total of 98 flaws. This is the first Patch Tuesday of 2023, and it fixes a whopping 98 vulnerabilities, with eleven of them classified as 'Critical.
If you procrastinated to deploy these updates the last two months, you are now running at high risk. January 2023 Patch Tuesday forecast There were no preview updates in December as usual due to the holidays, so the first release of the year is always interesting.
Fortinet has warned of a high-severity flaw affecting multiple versions of FortiADC application delivery controller that could lead to the execution of arbitrary code. The vulnerability, tracked as CVE-2022-39947 and internally discovered by its product security team, impacts the following versions -.
Business software provider Zoho has urged customers to patch a critical security flaw affecting multiple ManageEngine products."We identified a SQL injection vulnerability in our internal framework that would grant all [.] users unauthenticated access to the backend database," Zoho said.
Synology has released security updates to address a critical flaw impacting VPN Plus Server that could be exploited to take over affected systems.Tracked as CVE-2022-43931, the vulnerability carries a maximum severity rating of 10 on the CVSS scale and has been described as an out-of-bounds write bug in the remote desktop functionality in Synology VPN Plus Server.
Microsoft has pushed out an emergency fix for a problem in Windows Server caused by patch updates that made it impossible for some organizations to create virtual machines on Hyper-V hosts. The issue arose after Windows Server 2019 and Windows Server 2022 users installed two updates that were part of this month's Patch Tuesday releases.
According to Action1's 2021 Remote IT Management Challenges Report, 78% of organizations admit that they failed to patch critical vulnerabilities in a timely manner during the past year, and 62% said they suffered a breach due to a known vulnerability for which patch was available but not yet applied. It's not just the sheer volume that's a problem - each device might have its own hardware configuration and installed software, which adds a great deal of complexity to the patch management process.
Some users running Windows 10 who installed the KB5021233 cumulative update this month are seeing their operating system crash with the Blue Screen of Death, Microsoft is warning. In an entry over the weekend in its Windows Health Dashboard, the company wrote that the update might cause "a mismatch between the file versions of hidparse.sys in c:/windows/system32 and c:/windows/system32/drivers, which might cause signature validation to fail when cleanup occurs."