Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday

Summary: Microsoft's September 2022 Patch Tuesday fixed at least 64 Windows vulnerabilities, including CVE-2022-37969, a privilege escalation flaw in the Windows Common Log File System Driver that Microsoft says is already being exploited in the wild. Trend Micro's Dustin Childs flagged CVE-2022-34718, a remote code execution flaw in the Windows TCP/IP service that could let an unauthenticated attacker run code with elevated privileges without user interaction, putting it in the wormable category at CVSS 9.8, though only systems with IPv6 enabled and IPSec configured are vulnerable.
Key Takeaway: CVE-2022-37969 has no known workaround, so patching is the only effective mitigation, and it follows CVE-2022-24521, a similar flaw in the same Windows log file component that was also exploited in the wild after its April 2022 patch. The wormable TCP/IP bug reaches any host running IPv6 with IPSec, which is common in corporate networks.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-24521 CVE-2022-32983 CVE-2022-32984 CVE-2022-34700 CVE-2022-34718 CVE-2022-34721 CVE-2022-34722 CVE-2022-35803 CVE-2022-35805 CVE-2022-37969
Related: Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities Cyber Risks ·
CVE-2022-37969: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Sep 14, 2022
CVE-2022-24521: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022