Microsoft Fixes 121 Security Flaws in August Patch Tuesday

In this month’s Patch Tuesday, Microsoft fixed 121 flaws in total, including two zero-day vulnerabilities that are actively exploited. Among 121, 17 vulnerabilities with critical ratings could allow RCE and privilege escalation.

The fixed vulnerabilities fall into the following categories, with their counts:

• Elevation of Privilege (64)
• Security Feature Bypass (6)

• Remote Code Execution (31)
• Information Disclosure (12)
• Denial of Service (7)
• Spoofing (1)

Patched Zero Days

One of the zero-day vulnerabilities is CVE-2022-34713, which is better known as DogWalk. It is an RCE vulnerability existing in Windows Support Diagnostic Tool (MSDT) for over two years, and its exploit code is publicly accessible. Exploiting DogWalk allows an attacker to insert malicious executables into the Windows Startup folder.

In Microsoft’s advisory, it is mentioned a user must interact and open a specially created file to cause exploitation. This can happen in phishing attacks. The user can get an email with the compromised file or enter a fake website created specifically by the attacker.

DogWalk was found in January 2020 by security researcher Imre Rad. However, Microsoft decided not to address it since it did not consider it to be a security risk. It was fixed in this month’s Patch Tuesday.

The other zero-day flaw, CVE-2022-30134, is an Information Disclosure vulnerability in Microsoft Exchange. It enables an attacker to read certain emails. Despite being officially published, Microsoft claims that CVE-2022-30134 has not yet been exploited in attacks.

DogWalk Enters the List of Known Exploited Vulnerabilities

CISA also has warned about DogWalk by adding it to the list of Known Exploited Vulnerabilities along with a vulnerability with path traversal abilities. Tracked as CVE-2022-30333, it affects the UnRAR utility on Linux and Unix. If exploited, CVE-2022-30333 could let an attacker extract malicious files to an arbitrary location during unpacking.

CISA advises applying the patches provided by vendors.

Apply the Patches

Microsoft’s Patch Tuesday updates in August can be found in the security update guide. A release note is also available.

The list below shows affected products/systems.