vulnerabilities Actively exploited vulnerability in Windows Time to update Windows! Microsoft has released patches for several dozen vulnerabilities, one of which cybercriminals are actively exploiting. Editorial Team May 11, 2022 On the latest Patch Tuesday (May 10) Microsoft released updates for 74 vulnerabilities. At least one of them is already being actively exploited by attackers. Thus, it’s a good idea to install patches as soon as possible. CVE-2022-26925 – the most dangerous of the addressed vulnerabilities Apparently, the most dangerous vulnerability addressed in this update pack is CVE-2022-26925, which is contained in the Windows Local Security Authority. However, the vulnerability scores 8.1 on the CVSS scale, which is relatively low. Nevertheless, Microsoft representatives believe that when this vulnerability is used in NTLM Relay attacks on Active Directory Certificate Services, the severity level of this bundle rises to CVSS 9.8. The reason for the increased severity level is that in such a scenario CVE-2022-26925 could allow an attacker to authenticate on a domain controller. The vulnerability can affect all Windows operating systems from Windows 7 (Windows Server 2008 for server systems) and later. Microsoft didn’t go into the details of the exploitation of this vulnerability; however, judging by the description of the problem, unknown attackers are already actively using exploits for CVE-2022-26925 in the wild. The good news is that, according to experts, exploiting this vulnerability in real attacks is quite difficult. The fix detects and denies anonymous connection attempts to the Local Security Authority Remote Protocol. However, according to the official FAQ, installing this update on Windows Server 2008 SP2 may affect backup software. Other vulnerabilities In addition to CVE-2022-26925, the latest update fixes several other vulnerabilities with a “critical” severity level. Among them are the CVE-2022-26937 RCE vulnerability in the Windows Network File System (NFS), as well as CVE-2022-22012 and CVE-2022-29130 – two RCE vulnerabilities in the LDAP service. Two other vulnerabilities were also already known to the public at the time the patches were published: CVE-2022-29972 – a bug in Insight Software’s Magnitude Simba Amazon Redshift driver, and CVE-2022-22713 – a DoS vulnerability in Windows Hyper-V. However, no attempts to exploit them have been detected to date. How to stay protected First and foremost, install the recent updates from Microsoft. If for some reason it’s impossible in your environment, refer to the FAQs, Mitigations, and Workarounds section of Microsoft’s official May 2022 Security Updates guide. Hopefully one of the methods described there can be used for protection from vulnerabilities that are relevant to your infrastructure. For our part, we recommend protecting every device connected to the internet with a reliable solution that can detect exploitation of previously unknown vulnerabilities.
Read next Meet the Trojan subscribers hungry to sign you up We explain how Android users fall victim to Trojan subscribers Jocker, MobOk, Vesub and GriftHorse.
Tips Reading between the lines: how to read e-books safely We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers
Tips The eMudhra certificate incident: how organizations can respond How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.