Information Technology

Microsoft has released 55 security fixes that resolve critical issues including Remote Code Execution (RCE). The Redmond giant’s latest round of patches, usually released on the second Tuesday of each month in what is known as Patch Tuesday, includes fixes for problems such as RCE vulnerabilities, information leaks, Elevation of Privilege (EoP), Use-After-Free issues, and out-of-bounds memory access.
Special Feature
Products impacted by June’s security update include the Windows operating system, Microsoft Office, Hyper-V Server, Azure, and Windows Defender. In total, three vulnerabilities are critical, one is moderate, and the rest are considered important. Many of the vulnerabilities patched this month relate to remote code execution, but Microsoft says that there are no reports of active exploitation in the wild with the exception of an update to CVE-2022-30190, a Microsoft Windows Support Diagnostic Tool (MSDT) vulnerability made public in May.  Also: Everything Microsoft revealed at its 2022 Xbox & Bethesda ShowcaseSome of the most severe vulnerabilities resolved in this update are:  CVE-2022-30136: CVSS 9.8, Windows Network File System RCE vulnerability. Attackers need to make an unauthenticated, crafted call to a Network File System (NFS) service to trigger the bug.CVE-2022-30163: CVSS 8.5, A Windows Hyper-V RCE vulnerability exploitable through a specially crafted application on a Hyper-V guest session.CVE-2022-30139: CVSS 7.5, A Windows Lightweight Directory Access Protocol (LDAP) RCE vulnerability but only if the MaxReceiveBuffer LDAP policy is set to a value higher than the default value.CVE-2022-30164: CVSS 8.4, Kerberos AppContainer security feature bypass. It was possible to circumvent the service ticketing feature which performs user access control checks.CVE-2022-30157: CVSS 8.8, Microsoft SharePoint Server RCE vulnerability. Attackers must be authenticated and have page creation permissions,CVE-2022-30165: CVSS 8.8, Windows Kerberos EoP security flaw. It was possible to spoof the Kerberos log on process when a remote credential guard connection was made via CredSSP.As noted by the Zero Day Initiative (ZDI), this is the first patch release in a long time that has not featured updates for the Print Spooler. Last month, Microsoft resolved 74 bugs in the May batch of security fixes. These included seven critical and one important flaw, with RCE, privilege escalation, information leaks, and spoofing making an appearance.  A month prior, the tech giant tackled two zero-day vulnerabilities during April’s Patch Tuesday. Earlier this month, Microsoft warned of the upcoming retirement of Internet Explorer. Support is ending for Internet Explorer 11 on June 15, impacting the Windows 10 client SKU (version 20H2 and later) and Windows 10 IoT (version 20H2 and later). IE Mode will be maintained in Microsoft Edge until at least 2029 to give developers time to modernize their IE applications. Alongside Microsoft’s Patch Tuesday round, other vendors, too, have published security updates which can be accessed below. More

Credit: Microsoft Microsoft is acquiring Miburo, a cyberthreat analysis company specializing in the detection of and response to foreign information operations. Microsoft is not disclosing the purchase price but announced the deal publicly on June 14. Miburo is based in New York City. According to its LinkedIn profile, the company specializes in social media investigations […] More

Image: Getty At least one ransomware group has been spotted using Exchange Server vulnerabilities to deploy BlackCat ransomware on target networks, according to Microsoft.  Microsoft has warned that one cyber-criminal gang has used an unpatched Exchange Server to gain entry to a target organization to deploy the notorious BlackCat/ALPHV ransomware. The company provides a case […] More

Image: Getty Images Security researchers have warned of “increasing and unsustainable stress levels” in the cybersecurity workforce resulting from persistent ransomware threats and looming, large-scale attacks, which are pushing security professionals towards abandoning the industry altogether. A report by cybersecurity company Deep Instinct found that 46% of senior and executive-level cybersecurity professionals have considered quitting […] More

Mysterious hacker hands typing on a laptop keyboard. Getty A newly discovered stealthy piece of Linux malware called Syslogk delivers a backdoor that remains hidden on the targeted machine until its controller, from anywhere on the internet, transmits so-called ‘magic packets’.  According to researchers at Avast, the Syslogk Linux rootkit delivers the backdoor trojan known […] More

If you’re a network administrator managing a Windows deployment in a large enterprise, be extra cautious here.  Microsoft Welcome to the latest installment of Ask ZDNet, where we answer the questions that make your IT guy go ‘Huh.’ In the mailbag this week: A reader wants to use the Windows 10 Pro license on an […] More

StackCommerce The following content is brought to you by ZDNet partners. If you buy a product featured here, we may earn an affiliate commission or other compensation. ZDNet Recommends With the possible exception of a certain “big game,” nobody watches TV for the commercials. That’s even more true when it comes to the internet. Ads […] More

If you’re carrying unencrypted data around with you, then you should stop doing that. The consequences of losing data can range from embarrassing to damaging to potentially opening up your company to legal headaches.But encrypting data on external drives used to be a pain. You had to run an application and sometimes that wouldn’t work on certain platforms, and it all would quickly turn into a big hassle.But those days are over. A drive like the new Kingston IronKey Vault Privacy 80 SSD More