Microsoft is urging users to patch a zero-day vulnerability dubbed Dogwalk that is actively being exploited in the wild. The bug (CVE-2022-34713) is tied to a Microsoft Windows Support Diagnostic Tool and allows a remote attacker to execute code on a vulnerable system.
The warning is part of a massive August Patch Tuesday update that included 121 flaws, 17 of which were critical and 101 carrying a Common Vulnerability Scoring System rating of Important.
“The volume of fixes released this month is markedly higher than what is normally expected in an August release. It’s almost triple the size of last year’s August release, and it’s the second largest release this year,” wrote Dustin Childs, Zero Day Initiative manager, in a Tuesday blog post.
Dogwalk Flaw Was Over Two-Years Old
The actively exploited Dogwalk bug was first reported to Microsoft in January 2020 by researcher Imre Rad. However, it wasn’t until a separate researchers began tracking the exploitation of a flaw dubbed Follina (CVE-2022-30190) that the Dogwalk bug was rediscovered. That renewed interest in Dogwalk appears to have motivated Microsoft to add the patch to this month’s round of fixes, according to a Tenable Patch Tuesday roundup report.
Microsoft states that CVE-2022-34713 is a “variant of” Dogwalk, but different. Microsoft scored the vulnerability as Important and warns that the exploitation of the bug can only be preformed by an adversary with physical access to a vulnerable computer. However, researchers at Zero Day Initiative outline how a remote attack might occur.
“There is an element of social engineering to this as a threat actor would need to convince a user to click a link or open a document,” Childs wrote.
Microsoft describes a possible attack as having a low complexity value, meaning it can be exploited easily and requires no advance system privileges to execute.
“This bug also allows code execution when MSDT is called using the URL protocol from a calling application, typically Microsoft Word,” Childs wrote. “It’s not clear if this vulnerability is the result of a failed patch or something new,” he added.
17 Critical Flaws
The most serious of the vulnerabilities patched on Tuesday include a trio of elevation of privilege vulnerabilities opening instances of Microsoft Exchange Server to attack. Microsoft has released a separate alert page for this flaw to help mitigate the flaws.
“All three vulnerabilities require authentication and user interaction to exploit — an attacker would need to entice a target to visit a specially crafted Exchange server, likely through phishing,” wrote Tenable regarding the Exchange Server bugs.
Back in the Patch Tuesday spotlight is a critical flaw (CVE-2022-35804) in Microsoft’s Server Message Block (SMB) client and server running on Windows 11 systems using Microsoft SMB 3.1.1 (SMBv3), according to the company. Microsoft categorized the bug as “Exploitation More Likely” and assigned an 8.8 severity rating to the flaw.
The flaw only affects Windows 11, which Zero Day Initiative said, “implies some new functionality introduced this vulnerability.” Researchers there said the SMB flaw could potentially be wormable between affected Windows 11 systems only when SMB server is enabled.
“Disabling SMBv3 compression is a workaround for this bug, but applying the update is the best method to remediate the vulnerability,” wrote Childs.
Rated between 8.5 to 9.8 in severity, Microsoft patched a remote code execution flaw (CVE-2022-34715) in its Windows Network File System. This is the fourth month in a row that Microsoft has deployed a critical NFS code execution patch. Interestingly, Microsoft describes the flaw as Important, while researchers warn the bug is Critical and should be a priority patch.
“To exploit this, a remote, unauthenticated attacker would need to make a specially crafted call to an affected NFS server. This would provide the threat actor with code execution at elevated privileges. Microsoft lists this as Important severity, but if you’re using NFS, I would treat it as Critical. Definitely test and deploy this fix quickly,” advises Zero Day Initiative.
In related news, Adobe patched 25 CVEs on Tuesday tackling bugs in Adobe Acrobat and Reader, Commerce, Illustrator, FrameMaker and Adobe Premier Elements.