November 2023 Patch Tuesday forecast: Year 21 begins
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-22515 | Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server Atlassian Confluence Data Center and Server contain a broken access control flaw (CWE-20) in publicly accessible instances that allows unauthenticated remote attackers to create unauthorized Confluence administrator accounts and gain access to the instance; the associated public PoC is titled 'Atlassian Confluence Unauthenticated Remote Code Execution'. The flaw is triggered over the network (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N) against any self-managed Confluence instance reachable from the internet, with no privileges or user interaction required. Attackers who exploit it gain administrator-level control of the Confluence instance, and the public PoC demonstrates this extends to unauthenticated code execution. Only self-managed Confluence Data Center and Server deployments are affected; Atlassian Cloud sites hosted on atlassian.net domains are not vulnerable. Exploitation is confirmed in the wild: CISA added it to the KEV on 2023-10-05 with known ransomware use, EPSS is 99.2%, Atlassian reported a handful of customers were already exploited, and Microsoft warned of nation-state (China-linked) abuse. Do: Patch all internet-facing Confluence Data Center and Server instances to a fixed release per Atlassian's advisory (specific fixed versions are not listed in this data), or restrict public access/discontinue use per CISA's required action. Audit every affected instance for evidence of compromise, especially unauthorized administrator accounts created through this flaw, and report positive findings to CISA. Treat this as urgent given active exploitation by both nation-state actors and ransomware groups. | 9.8 | 99% | KEV ransomware PoC |
| large≈ tens of thousands of internet-exposed Confluence Data Center/Server instances (order of ~30,000-50,000) | |
| CVE-2023-22518 | Improper Authorization in Atlassian Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an improper authorization flaw (CWE-863) that can be triggered by an unauthenticated attacker sending crafted requests to a vulnerable instance. Successful exploitation gives the attacker control over the instance and can cause significant data loss, such as wiping or resetting the Confluence site, but there is no confidentiality impact because no data can be exfiltrated. Any organization running a self-managed Confluence Data Center or Server deployment is in scope. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-07 with ransomware use noted, and EPSS assigns it a 100% probability of exploitation within 30 days. No public proof-of-concept is known, but ransomware operators are already using the flaw in the wild. Do: Upgrade every Confluence Data Center and Server instance to the patched release for your branch listed in Atlassian's advisory, per the CISA KEV required action (apply vendor mitigations or discontinue use). In the interim, restrict internet access to Confluence and check for signs of compromise such as unexpected instance resets, missing data, or ransom notes; restore from backups if data loss is detected. | 9.8 | 100% | KEV ransomware PoC |
| large≈70,000+ internet-exposed Confluence instances per public scans, likely 100k+ total self-managed installations |
Full article836 words · extracted from helpnetsecurity.com · click to collapse
The October forecast for large numbers of CVEs addressed in Windows 10 and 11 and the recent record on the number fixed in Windows Server 2012 was spot on! Microsoft addressed 75 CVEs in Windows 11, 80 in Windows 10, and 61 in Server 2012 R2. While Server 2012 and Server 2012 R2 may be in good shape for the short term, please don’t count on it for long, and don’t forget they are moving into Extended Security Updates this month. This was a fine way to end 20 years of Patch Tuesdays!
A new decade of Patch Tuesday
Next week, we enter the third decade of Patch Tuesday releases from Microsoft. Patch Tuesday has had a significant impact on the software industry. Software updates across the board had been haphazard and happenstance until that second Tuesday in October 2003. Microsoft decided to provide some predictability to their software releases with the announcement of regularly scheduled updates, and it soon spawned the start of a patch management process.
IT administrators could finally plan for and notify their organization the software updates were coming, and then deploy them orderly. Patch uptake improved, and it wasn’t long before other vendors took the same approach, often releasing in conjunction with Microsoft, or at least on their own pre-announced, regular schedule. In addition to Microsoft improving its patch management tools, an entire industry provided a wide assortment of tools for IT to use. I don’t have to forecast another decade of continued growth and improvements.
Microsoft’s security expertise
One such improvement is Microsoft Security Copilot which has been introduced for limited, early access. Per the announcement this is “an AI assistant for security teams that builds on the latest in large language models and harnesses Microsoft’s security expertise and global threat intelligence to help security teams outpace their adversaries.” It can take common language queries, consult with Microsoft threat intelligence, deep security knowledge libraries, and other Microsoft sources to provide analysis and recommendations for action. It can provide output in the form of text, code, diagrams, etc. which can be specific to Microsoft products. It can greatly expand the security team’s security knowledge and capabilities.
This product is an important part of the Microsoft’s Secure Future Initiative to use AI in a number ways including cyber defense and advancing software engineering, while ensuring that AI is being used responsibly worldwide.
Windows 11 23H2
Microsoft officially released Windows 11 23H2 on October 31st. It is available via an iso image for a new install and as an enablement package from Windows 11 22H2 which we haven’t seen for any recent feature updates. It includes all the ‘Moment 4’ feature updates released last month for Windows 11 22H2. As I mentioned last month, a big security feature in this release is the Windows Passkey Manager which uses biometric data or security keys to log into websites without a password thus helping combat phishing attacks.
Atlassian
There are a few important CVEs to be aware of this month. Atlassian has been in the news again with exploits targeted at their Confluence Data Center and Server technology. In early October, they reported CVE-2023-22515 under attack and now CVE-2023-22518 is in the same situation. These are both rated with CVSS 10.0, so immediate updates are recommended. And regarding CVSS, FIRST announced the office release of CVSS Version 4.0 on October 31st as planned. Expect to see reference to the new CVSS 4.0 scores from Microsoft and others soon.
November 2023 Patch Tuesday forecast
- Expect a smaller number of CVEs addressed next week in the Microsoft operating systems after the big push last month. There may be a bigger focus on the Office applications and perhaps a .NET framework update.
- Adobe has been consistent with major updates at the end of each quarter, so I anticipate the next one in December. If an important zero-day surfaces they may release something next week so always watch for a pre-announcement in the next day or so.
- Apple released security updates for Sonoma, Ventura, and iOS this week so ensure you factor them into your patch deployment for next week if you haven’t already. Be on the lookout for a Monterey update just in case some of the CVEs apply to that OS.
- The ChromeOS LTS channel was updated to 114.0.5735.339 this week addressing 5 High rated CVEs. Take those into account next week if you haven’t deployed them. There were beta updates this week for Chrome Desktop and standard ChromeOS, so expect those to release next week.
- Mozilla released their last round of updates for Firefox, Firefox ESR and Thunderbird on October 24, so we may see some minor updates next week.
The importance of Patch Tuesday has grown over the years. Threats have increased dramatically since those early days, to the point that the Tuesday-released patches need to be distributed quickly to protect against zero-day and the large volume of reported vulnerabilities. Continue to fight the good fight next week as year 21 of Patch Tuesdays begins.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/11/10/november-2023-patch-tuesday-forecast/