HC3 TLP Clear: Monthly Cybersecurity Vulnerability Bulletin (December) - January 19, 2023

December Vulnerabilities of Interest to the Health Sector

In December 2022, vulnerabilities to the health sector have been released that require attention. This includes the monthly Patch Tuesday vulnerabilities released by several vendors on the second Tuesday of each month, along with mitigation steps and patches. Vulnerabilities for this month are from Microsoft, Google/Android, Apple, Intel, Cisco, SAP, Citrix, VMWare, and Fortinet. A vulnerability is given the classification as a zero-day if it is actively exploited with no fix available or is publicly disclosed. HC3 recommends patching all vulnerabilities with special consideration to the risk management posture of the organization.

Importance to the HPH Sector

Department Of Homeland Security/Cybersecurity & Infrastructure Security Agency
The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) added a total of 9 vulnerabilities in December to their Known Exploited Vulnerabilities Catalog.

This effort is driven by Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, which established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the U.S. federal enterprise.

Vulnerabilities that are entered into this catalog are required to be patched by their associated deadline by all U.S. executive agencies. While these requirements do not extend to the private sector, HC3 recommends all healthcare entities review vulnerabilities in this catalog and consider prioritizing them as part of their risk mitigation plan. The full database can be found here.

Microsoft

Microsoft released fixes for two zero-day vulnerabilities, one of which is actively exploited, and 49 flaws. Six of the 49 vulnerabilities addressed in this month’s Patch Tuesday are classified as 'Critical' as they allow remote code execution, one of the most severe types of vulnerabilities. The number of bugs in each vulnerability category is listed as follows:

• 19 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 23 Remote Code Execution Vulnerabilities
• 3 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerability

The numbers above do not include twenty-five Microsoft Edge vulnerabilities fixed on December 5th.

View the detailed report below.