SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Microsoft Patch Tuesday for Jan. 2021 — Snort rules and prominent vulnerabilities
Description: Microsoft released its monthly security update Tuesday, disclosing 102 vulnerabilities across its large collection of hardware and software. This is the largest amount of vulnerabilities Microsoft has disclosed in a monthly security update in eight months, however, none of the issues have been exploited in the wild, according to Microsoft. 2022’s first security update features nine critical vulnerabilities, with all but one of the remaining being considered “important.” CVE-2022-21840 is one of the critical vulnerabilities, an issue in Microsoft Office that could allow an attacker to execute remote code on the targeted machine. CVE-2022-21841, CVE-2022-21837 and CVE-2022-21842 are also remote code execution vulnerabilities in the Office suite of products, though they are only rated as “important.” These four vulnerabilities are particularly of note, though, because they can be triggered by the target opening a specially crafted document, a favorite tactic of attackers.
Reference: https://blog.talosintelligence.com/2022/01/microsoft-patch-tuesday-for-jan-2022.html
Snort SIDs: 40689, 40690, 58859, 58860, 58866 - 58869 and 58870 - 58875
Title: Two vulnerabilities in Adobe Acrobat DC could lead to arbitrary code execution
Description: Cisco Talos recently discovered two vulnerabilities in Adobe Acrobat Reader DC that could allow an attacker to eventually gain the ability to execute arbitrary code. Acrobat is one of the most popular PDF reader software options available currently. It includes the ability to read and process JavaScript to give PDFs greater interactivity and customization options for users. Both vulnerabilities exist in the way Acrobat Reader processes JavaScript. CVE-2021-44710 is a use-after-free vulnerability that is triggered if the user opens a PDF with specially crafted, malicious JavaScript. The code could give attackers control over reused memory, which can lead to arbitrary code execution. Similarly, CVE-2021-44711 also is triggered if the target opens a specially crafted PDF file, however, this vulnerability causes an integer overflow condition, which could eventually lead to code execution. There are several other vulnerabilities Adobe disclosed in its suite of products as part of Patch Tuesday.
References:
- https://blog.talosintelligence.com/2022/01/adobe-acrobat-vuln-spotlight-.html
- https://helpx.adobe.com/security/security-bulletin.html
Snort SIDs: 58367, 58368, 58553 and 58554