Microsoft patches exploited 'Follina' remote code exec bug

The Follina vulnerability in Microsoft Office that has been exploited by attackers to plant remote access tools like Qbot and AsyncRAT is now fixed in the latest set of Patch Tuesday security updates.

Follina uses a uniform resource locator (URL) calling from Office applications like Word, to remotely execute code, and compromise victim computers.

"An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application", Microsoft said in its advisory.

"The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights".

For those looking for the Follina / CVE-2022-30190 update in the June 2022 Patch Tuesday updates, take note:
Despite the patches being released today, they're listed as being released in May. ��
With the update, msdt.exe is still automatically spawned. But without injection. pic.twitter.com/A0xl28eYhC

— Will Dormann (@wdormann) June 14, 2022

This month's Patch Tuesday addresses 55 vulnerabilities in the Windows operating system and sub-components, as well as Microsoft Office, and several other apps.

Three of the 55 vulnerabilities are rated as critical.

They affect Windows, and allow for remote code execution in the Network File System (NFS) version 4.1 component, the lightweight directory access protocol (LDAP) implementation, and the Hyper-V hypervisor.

None of the three are known to be exploited in the wild.