erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: October 11, 2022

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Windows Print Spooler CVE-2022-38028: GRU's GooseEgg Tool. Owners of Windows hosts with no update since October 2022, especially unsupported Windows 8.1 and Server 2012/2012 R2 machines, and government, NGO, education and transportation organizations in Ukraine, Europe and North America.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2022-38028

Windows Print Spooler CVE-2022-38028: GRU's GooseEgg Tool

Any Windows update since October 2022 fixes this; the remaining work is finding hosts that never got it, turning the spooler off on domain controllers, and checking for GooseEgg where Forest Blizzard may have been active.

Must act: Owners of Windows hosts with no update since October 2022, especially unsupported Windows 8.1 and Server 2012/2012 R2 machines, and government, NGO, education and transportation organizations in Ukraine, Europe and North America.

Can relax: Fleets that have installed any monthly update since October 11, 2022; Windows 7 and Server 2008 are not in Microsoft's affected list.

  1. Confirm every Windows host has an October 2022 or later update by reading its build and UBR.
  2. Disable the Print Spooler service on domain controllers, as Microsoft recommends.
  3. Confirm the PrintNightmare fixes (CVE-2021-1675, CVE-2021-34527) are also installed.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.