Black Arrow Cyber Advisory 15/06/2022 – Microsoft Patch Tuesday – ‘Follina’ vulnerability addressed with other security updates

Executive Summary

Microsoft’s June Patch Tuesday provides updates across all Windows platforms to address critical security issues. This includes updates that address a critical zero-day flaw which allows remote malicious access to the Microsoft Windows Support Diagnostic Tool (MSDT) through Microsoft Office, which has commonly been named ‘Follina’.

Internet Explorer is also set to officially retire today, meaning that going forward any legacy applications will need to be accessed using Microsoft Edge’s Internet Explorer Mode.

Security updates have also been released for other Microsoft products to tackle different issues.

What’s the risk to me or my business?

Security updates are available for all supported versions of Windows. As some of these updates address vulnerabilities that are known to be actively exploited, the updates should be applied as soon as possible.

What can I do?

Apply the available updates from Microsoft as soon as possible, while taking into consideration any potential downtime that these updates may cause.

If legacy applications are still present that require Internet Explorer, then access to these should be advised through Microsoft Edge’s Internet Explorer Mode. As these applications are very likely to be unsupported themselves, steps should be taken to either move away from the legacy applications, or to establish firm risk-based controls for protection and use of the applications.

Technical Summary

CVE-2022-30190 relate to the ‘Follina’ vulnerability. The timeline for the actual disclosure of this issue to Microsoft is not completely clear, there are reports that the issue was originally identified within a university dissertation back in August 2020, with multiple occasions after that where the issue had been reported to Microsoft without a formal CVE being raised. Microsoft has now raised a formal CVE: CVE-2022-30190 - Security Update Guide - Microsoft - Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability and has supplied mitigation steps: Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability – Microsoft Security Response Center. As a high-level summary, the exploit works by having word download template information from an external source over the internet, which contains malicious code that can execute the MSDT software, which in itself can execute PowerShell commands.

Further details on specific updates within this months Patch Tuesday can be found here: Microsoft Windows Security Updates June 2022 overview - gHacks Tech News

Information on Microsoft Edge’s Internet Explorer Mode can be found here: What is Internet Explorer mode? | Microsoft Docs

Need help understanding your gaps, or just want some advice? Get in touch with us.