Microsoft addressed three zero-day vulnerabilities March 2022 Patch Tuesday Update

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Microsoft addressed 71 the following vulnerabilities in their March 2022 Patch Tuesday Update. This advisory briefs about six vulnerabilities out of which three of them have been rated critical in severity and three of them are zero-days. Microsoft Patch Tuesday comprise of the following vulnerabilities: • 29 Remote Code Execution Vulnerabilities • 25 Elevation of Privilege Vulnerabilities • 6 Information Disclosure Vulnerabilities • 4 Denial of Service Vulnerabilities • 3 Security Feature Bypass Vulnerabilities • 3 Spoofing Vulnerabilities • 1 Tampering Vulnerability The three critical vulnerabilities are remote code execution bugs affecting Microsoft Exchange Server (CVE-2022-23277), HEVC Video Extensions (CVE-2022-22006), and VP9 Video Extensions (CVE-2022-24501). In addition to this, two out of the three zero-days are remote code execution (CVE-2022-24512 CVE-2022-21990) and one of them is a privilege escalation (CVE-2022-24459). A zero-day vulnerability, CVE-2022-21990 has been labeled as "Exploitation More Likely“ by Microsoft as a proof-of-concept (PoC) exploit is publicly available. All these vulnerabilities have been patched by Microsoft and we advise all organizations to apply patches for the same to avoid potential attacks. Potential Mitre ATT&CK TTPs are : TA0001: Initial Access TA0002: Execution TA0004: Privilege Escalation T1190: Exploit Public-Facing Application T1203: Exploitation of Client Execution T1068: Exploitation for Privilege Escalation Vulnerability Detail Patch Link https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21990 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24459 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23277 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22006 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24501 References https://msrc.microsoft.com/update-guide/releaseNote/2022-Mar https://www.cisa.gov/uscert/ncas/current-activity/2022/03/08/microsoft-releases-march-2022-security-updates https://msrc.microsoft.com/update-guide/en-us