Microsoft’s September security update for multiple high-risk product vulnerabilities

Microsoft’s September security update for multiple high-risk product vulnerabilities

setembro 15, 2022 | Jie Ji

Overview

On September 14, NSFOCUS CERT detected that Microsoft released the September security update patch, which fixed 63 security issues, involving widely used products such as Windows TCP/IP, .NET Framework, Windows Print Spooler Components, and Windows LDAP. Including high-risk vulnerability types such as privilege escalation and remote code execution.

Among the vulnerabilities fixed by Microsoft’s monthly update this month, there are 5 Critical vulnerabilities and 58 Important vulnerabilities, including 2 zero-day vulnerabilities:

Windows Common Log File System Driver Privilege Escalation Vulnerability (CVE-2022-37969)

Cache Speculation Limit Vulnerability (Arm) (CVE-2022-23960)

Relevant users are requested to update patches as soon as possible for protection. For a complete list of vulnerabilities, please refer to the appendix.

NSFOCUS RSAS has the ability to detect most of the vulnerabilities in Microsoft’s patch update (including high-risk vulnerabilities such as CVE-2022-37969, CVE-2022-34718, CVE-2022-34721, CVE-2022-34722, CVE-2022-34729), please pay attention to the update of the NSFOCUS RSAS plug-in upgrade package, and upgrade to V6.0R02F01.2812 in time.

Reference link: https://msrc.microsoft.com/update-guide/releaseNote/2022-Sep

Description of Major Vulnerabilities

According to the popularity of the product and the importance of the vulnerability, the most influential vulnerabilities contained in this update are screened out. Please pay attention to the relevant users:

Windows Common Log File System Driver Privilege Escalation Vulnerability (CVE-2022-37969):

A privilege escalation vulnerability exists in the Common Log File System (CLFS), because the application in the common log file system driver does not implement the correct security restrictions, a local attacker with low privileges can bypass the security restrictions by exploiting this vulnerability, thereby in the target system Elevate to SYSTEM privileges and execute arbitrary code. The vulnerability has been publicly disclosed and exploited in the wild, with a CVSS score of 7.8.

Official announcement link:

https://msrc.microsoft.com/update-guide/ch-ZN/vulnerability/CVE-2022-37969

Cache Speculation Limit Vulnerability (Arm) (CVE-2022-23960):

Because Arm Cortex and Neoverse processors do not enforce proper restrictions on cache speculation, the vulnerability has been publicly disclosed that, under certain configuration conditions, an authenticated local attacker could successfully exploit sensitive system information.

Official announcement link:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-23960

Windows TCP/IP Remote Code Execution Vulnerability (CVE-2022-34718):

There is a remote code execution vulnerability in Windows TCP/IP. Because Windows TCP/IP does not fully verify the data entered by the user, an unauthenticated remote attacker sends specially crafted IPv6 packets, which eventually leads to arbitrary code execution on the target system. According to Microsoft official notice, only systems running IPSec services may be vulnerable to the vulnerability. The CVSS score was 9.8.

Official announcement link:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-34718

Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability (CVE-2022-34700/CVE-2022-35805):

There is a remote code execution vulnerability in Microsoft Dynamics CRM (on-premises). Because Dynamics CRM does not sufficiently filter the data entered by the user, an authenticated remote attacker can send a specially crafted request to the Dynamics 365 database as db_owner. Permission to execute commands arbitrarily without user interaction. The CVSS score was 8.8.

Official announcement link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34700

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35805

Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (CVE-2022-34721/CVE-2022-34722):

Because the applications in the IKE Protocol Extensions do not enforce proper security restrictions, an unauthenticated remote attacker can eventually execute arbitrary code on the target server by sending specially crafted IP packets to the IPSec-enabled computer, and No user interaction is required. The CVSS score was 9.8.

Official announcement link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34721

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34722

Windows Kernel Privilege Escalation Vulnerability (CVE-2022-37957):

A privilege escalation vulnerability exists in the Windows Kernel. Since the Windows Kernel does not implement the correct security restrictions, a local attacker with low privileges can bypass the security restrictions by exploiting this vulnerability, thereby escalating to the SYSTEM privilege on the target system and executing arbitrary code without the need for User interaction. The CVSS score was 7.8.

Official announcement link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37957

Windows GDI Privilege Escalation Vulnerability (CVE-2022-34729):

A privilege escalation vulnerability exists in Windows GDI. Because Windows GDI does not implement the correct security restrictions, a local attacker with low privileges can bypass the security restrictions by exploiting this vulnerability, thereby escalating to SYSTEM privileges on the target system and executing arbitrary code without the need for a user. interact. The CVSS score was 7.8.

Official announcement link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34729

Windows ALPC Privilege Escalation Vulnerability (CVE-2022-34725):

There is a privilege escalation vulnerability in Windows ALPC. Due to the flaws in the security restrictions of Windows ALPC, in a specific configuration environment, a local attacker with low privileges can bypass the security restrictions by exploiting this vulnerability, thereby elevating to the SYSTEM privilege on the target system and executing Arbitrary code without user interaction. The CVSS score was 7.0.

Official announcement link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34725

Scope of Impact

The following are the affected product versions that focus on the vulnerability. For other products affected by the vulnerability, please refer to the official announcement link.

Vulnerability numberAffected Product Version
CVE-2022-37969Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1 Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
CVE-2022-34718Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1 Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
CVE-2022-34700 CVE-2022-35805Microsoft Dynamics CRM (on-premises) 9.1
Microsoft Dynamics CRM (on-premises) 9.0
CVE-2022-34721 CVE-2022-34722Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019 Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2 Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1 Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
CVE-2022-34724Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
CVE-2022-37957Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 11 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
CVE-2022-34729Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows 11 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
CVE-2022-34725Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 11 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems

Mitigation

Patch Update

At present, Microsoft has officially released a security patch to fix the above vulnerabilities for supported product versions. It is strongly recommended that affected users install the patch as soon as possible for protection. The official download link:

https://msrc.microsoft.com/update-guide/releaseNote/2022-Sep

Note: Due to network problems, computer environment problems, etc., the patch update of Windows Update may fail. After installing the patch, the user should promptly check whether the patch is successfully updated.

Right-click the Windows icon, select “Settings (N)”, select “Update and Security” – “Windows Update”, and view the prompt information on this page. You can also click “View Update History” to view the historical update status.

For updates that are not successfully installed, you can click the update name to jump to the official Microsoft download page. It is recommended that users click the link on this page and go to the “Microsoft Update Catalog” website to download and install the independent package.

Appendix

Affected productCVE No.VulnerabilitySeverity
Microsoft Dynamics CRMCVE-2022-34700Microsoft Dynamics 365 (on-premises) Remote Code Execution VulnerabilityCritical
Microsoft Dynamics CRMCVE-2022-35805Microsoft Dynamics 365 (on-premises) Remote Code Execution VulnerabilityCritical
WindowsCVE-2022-34721Windows Internet Key Exchange (IKE) Protocol Extension Remote Code Execution VulnerabilityCritical
WindowsCVE-2022-34722Windows Internet Key Exchange (IKE) Protocol Extension Remote Code Execution VulnerabilityCritical
WindowsCVE-2022-34718Windows TCP/IP Remote Code Execution VulnerabilityCritical
WindowsCVE-2022-37969Microsoft Exchange Server Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-23960 *CVE-2022-23960 Cache Speculation Limit VulnerabilityImportant
Microsoft Visual StudioCVE-2022-38013.NET Core and Visual Studio Denial of Service VulnerabilityImportant
Microsoft .NET FrameworkCVE-2022-26929.NET Framework Remote Code Execution VulnerabilityImportant
AV1 Video ExtensionCVE-2022-38019AV1 Video Extension Remote Code Execution VulnerabilityImportant
AzureCVE-2022-38007Server Privilege Escalation Vulnerability in Azure Guest Configuration and Azure ARC SupportImportant
WindowsCVE-2022-37954Elevation of Privilege Vulnerability in DirectX Graphics KernelImportant
WindowsCVE-2022-35838HTTP V3 Denial of Service VulnerabilityImportant
Microsoft Defender for Endpoint for MacCVE-2022-35828Elevation of Privilege Vulnerability in Microsoft Defender for Endpoint for MacImportant
WindowsCVE-2022-34726Microsoft ODBC Driver Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-34727Microsoft ODBC Driver Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-34730Microsoft ODBC Driver Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-34732Microsoft ODBC Driver Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-34734Microsoft ODBC Driver Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2022-37963Microsoft Office Visio Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2022-38010Microsoft Office Visio Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-34731Microsoft OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-34733Microsoft OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-35834Microsoft OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-35835Microsoft OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-35836Microsoft OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-35840Microsoft OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2022-37962Microsoft PowerPoint Remote Code Execution VulnerabilityImportant
Microsoft SharePointCVE-2022-35823Microsoft SharePoint Remote Code Execution VulnerabilityImportant
Microsoft SharePoint ServerCVE-2022-37961Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant
Microsoft SharePoint ServerCVE-2022-38008Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant
Microsoft SharePoint ServerCVE-2022-38009Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant
Windows ServerCVE-2022-37959NDES Security Feature Bypass VulnerabilityImportant
Raw Image ExtensionCVE-2022-38011Original Image Extension Remote Code Execution VulnerabilityImportant
Windows ServerCVE-2022-35830Remote Procedure Call Runtime Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-37958NEGOEX Security Mechanism Information Disclosure VulnerabilityImportant
Visual Studio CodeCVE-2022-38020Visual Studio Code Privilege Escalation VulnerabilityImportant
WindowsCVE-2022-34725Windows ALPC Privilege Escalation VulnerabilityImportant
WindowsCVE-2022-35803Windows Generic Journaling File System Driver Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-30170Windows Credential Roaming Service Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-34719Windows Distributed File System (DFS) Elevation of Privilege VulnerabilityImportant
Windows ServerCVE-2022-34724Windows DNS Server Denial of Service VulnerabilityImportant
WindowsCVE-2022-34723Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure VulnerabilityImportant
WindowsCVE-2022-35841Windows Enterprise Application Management Services Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-35832Windows Event Tracing Denial of Service VulnerabilityImportant
WindowsCVE-2022-38004Windows Fax Service Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-34729Windows GDI Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-38006Windows Graphics Component Information Disclosure VulnerabilityImportant
WindowsCVE-2022-34728Windows Graphics Component Information Disclosure VulnerabilityImportant
WindowsCVE-2022-35837Windows Graphics Component Information Disclosure VulnerabilityImportant
WindowsCVE-2022-37955Windows Group Policy Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-34720Windows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityImportant
Windows ServerCVE-2022-33647Windows Kerberos Elevation of Privilege VulnerabilityImportant
Windows ServerCVE-2022-33679Windows Kerberos Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-37956Windows Kernel Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-37957Windows Kernel Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-37964Windows Kernel Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-30200LDAP Remote Code Execution VulnerabilityImportant
WindowsCVE-2022-26928Windows Photo Import API Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-38005Windows Print Spooler Elevation of Privilege VulnerabilityImportant
WindowsCVE-2022-35831Windows Remote Access Connection Manager Information Disclosure VulnerabilityImportant
WindowsCVE-2022-30196Windows Secure Channel Denial of Service VulnerabilityImportant
WindowsCVE-2022-35833Windows Secure Channel Denial of Service VulnerabilityImportant

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.