Tripwire Patch Priority Index for January 2022

Image

Tripwire's January 2022 Patch Priority Index (PPI) brings together important vulnerabilities for Apache, Open Source Policy Kit, Adobe, and Microsoft.

First on the patch priority list this month are patches for Apache Log4j2 vulnerabilities, most importantly for the Log4j2 "LogShell" remote code execution vulnerability (CVE-2021-44228). This vulnerability made it on the December 2021 priority list, and it is back this month because it has been recently added to the Metasploit Exploit Framework. These systems should be patched as soon as possible.

Up next is a remote code execution in the Windows HTTP protocol stack. This vulnerability can be exploited over the network with no authentication required. Microsoft states that this vulnerability is wormable. Administrators should ensure this vulnerability is patched as soon as possible.

Next on the list is the so-called "PWNkit" vulnerability. This is a local privilege escalation vulnerability that potentially impacts any Linux operating system. The vulnerability exists in the PolicyKit (aka, polkit) pkexec application and allows a low privileged user to easily gain access to root with ease. Several proof-of-concepts are available on GitHub. The main requirements is that PolicyKit is installed on a target system and a malicious actor has the ability to login as a regular user. Many Linux distributions such as RedHat, Ubuntu, Amazon Linux, etc. have released patches to resolve this vulnerability.

Up next are patches for Microsoft Edge that resolve over 20 vulnerabilities such as user after free, type confusion, heap buffer overflow, and data validation vulnerabilities.

Following Edge, administrators should apply patches for Adobe Reader and Acrobat based on the APSB22-01 patch release. These patches resolve over 25 vulnerabilities and fix issues such as use after free, information exposure, stack-based buffer overflow, heap-based buffer overflow, and out of bounds write vulnerabilities.

Next are patches for Microsoft Office, Excel, and Word. These patches resolve 3 remote code execution vulnerabilities.