The company said the flaw (tracked as CVE-2022-21907) is quite potent and has released a patch in this month’s Patch Tuesday. Furthermore, they recommended that users prioritize patching affected servers.
Vulnerability Lies with HTTP Protocol Stack
The vulnerability lies in the HTTP Protocol Stack (HTTP.sys). This is a protocol listener used to process HTTP requests by the Windows IIS web server. To carry out a successful attack, threat actors would have to send maliciously crafted packets targeting Windows servers that use the vulnerable HTTP Protocol Stack. Microsoft said the flaw could allow attacks to remotely execute malicious code without any user interaction. Therefore, they recommend that users apply the patch on all affected servers. On a positive note, the flaw is not yet under active exploitation. There are no publicly available proof-of-concept exploits either. The HTTP Protocol Stack feature is not enabled by default on Windows Server 2019 and Windows 10 version 1809. This is important since disabling the feature is enough to protect vulnerable devices.
Companies Potentially Safe: Home Users Urged to Apply Patch ASAP
Microsoft stated that most companies are very likely to be secure. This is because they rarely run the latest versions of Windows on office devices. However, home users should be on alert and apply the patch as soon as possible. As mentioned earlier, Microsoft has already issued a patch in this month’s Patch Tuesday. It addressed 97 different flaws, including six zero-day exploits. These vulnerabilities included 41 related to privilege escalation, 29 to remote code execution (RCE), nine to denial of service (DOS), nine to security feature bypass, and six pertaining to information disclosure.
Advice for Home Users: Use Good Antivirus Software
For a home user, information about newly discovered security vulnerabilities with commonly used devices and software can be quite unsettling. It is very difficult, and cumbersome, to stay up-to-date with every discovery in the cybersecurity world. It is important to immediately apply patches or software updates recommended by service providers to address security vulnerabilities. Apart from applying a security patch, good antivirus software can be of great help. These programs ensure that you can use your phone, laptop, and other smart devices without having to worry about dangers such as malware. If you’re looking for a good antivirus program, head over to our article on the best antivirus in 2022!
