Microsoft's Final 2023 Patch Tuesday: 34 Flaws Fixed, Including 4 Critical
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-3236 | Unauthenticated Code Injection RCE in Sophos Firewall (User Portal/Webadmin) CVE-2022-3236 is a critical (CVSS 9.8) code injection flaw (CWE-94) in the User Portal and Webadmin interfaces of Sophos Firewall version v19.0 MR1 and older. A remote, unauthenticated attacker can send crafted input to an exposed User Portal or Webadmin service, and the network-reachable, no-privilege, no-user-interaction nature of the flaw makes it trivially triggerable once those interfaces are reachable. Successful exploitation results in arbitrary code execution on the firewall appliance, with high impact to confidentiality, integrity, and availability. Any organization running Sophos Firewall v19.0 MR1 or older is affected, including end-of-life appliances for which the vendor issued a dedicated hotfix. The flaw is confirmed exploited in the wild: it was abused as a zero-day before the patch, added to CISA KEV on 2022-09-23, carries a 98.9% EPSS, and news reports indicate it was still being exploited against EOL firewalls well after disclosure. Do: Upgrade Sophos Firewall to version 19.5 or later per vendor instructions (the fix shipped in the 19.5 release line), and apply the vendor hotfix to end-of-life appliances that cannot upgrade. Restrict internet exposure of the User Portal (TCP 443) and Webadmin (TCP 4444) to trusted management IPs via WAN access rules, and review appliance logs for signs of exploitation. As this CVE is in CISA KEV, federal agencies and other defenders with KEV-driven patch mandates should confirm the update is applied. | 9.8 | 99% | KEV |
| masshundreds of thousands of deployed Sophos Firewall appliances; tens of thousands of User Portal/Webadmin instances internet-exposed per public scans | |
| CVE-2023-21751 | Azure DevOps Server Spoofing Vulnerability Azure DevOps Server Spoofing Vulnerability NVD description · AI analysis pending | 6.5 | <1% |
| — | ||
| CVE-2023-35628 | Windows MSHTML Platform Remote Code Execution Vulnerability Windows MSHTML Platform Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.1 group max | 93% |
| — | ||
| CVE-2023-35636 | Microsoft Outlook Information Disclosure Vulnerability Microsoft Outlook Information Disclosure Vulnerability NVD description · AI analysis pending | 6.5 | 18% |
| — | ||
| CVE-2023-35638 +1 in the same advisory: …35643 | DHCP Server Service Denial of Service Vulnerability DHCP Server Service Denial of Service Vulnerability NVD description · AI analysis pending | 7.5 | 3% |
| — | ||
| CVE-2023-36012 | DHCP Server Service Information Disclosure Vulnerability DHCP Server Service Information Disclosure Vulnerability NVD description · AI analysis pending | 5.3 | 2% |
| — | ||
| CVE-2023-36019 | Microsoft Power Platform Connector Spoofing Vulnerability Microsoft Power Platform Connector Spoofing Vulnerability NVD description · AI analysis pending | 7.4 | 16% |
| — |
Full article698 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 13, 2023Patch Tuesday / Windows Security
Microsoft released its final set of Patch Tuesday updates for 2023, closing out 34 flaws in its software, making it one of the lightest releases in recent years.
Of the 34 shortcomings, four are rated Critical and 30 are rated Important in severity. The fixes are in addition to 18 flaws Microsoft addressed in its Chromium-based Edge browser since the release of Patch Tuesday updates for November 2023.
According to data from the Zero Day Initiative, the software giant has patched more than 900 flaws this year, making it one of the busiest years for Microsoft patches. For comparison, Redmond resolved 917 CVEs in 2022.
While none of the vulnerabilities are listed as publicly known or under active attack at the time of release, some of the notable ones are listed below -
- CVE-2023-35628 (CVSS score: 8.1) - Windows MSHTML Platform Remote Code Execution Vulnerability
- CVE-2023-35630 (CVSS score: 8.8) - Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
- CVE-2023-35636 (CVSS score: 6.5) - Microsoft Outlook Information Disclosure Vulnerability
- CVE-2023-35639 (CVSS score: 8.8) - Microsoft ODBC Driver Remote Code Execution Vulnerability
- CVE-2023-35641 (CVSS score: 8.8) - Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
- CVE-2023-35642 (CVSS score: 6.5) - Internet Connection Sharing (ICS) Denial-of-Service Vulnerability
- CVE-2023-36019 (CVSS score: 9.6) - Microsoft Power Platform Connector Spoofing Vulnerability
CVE-2023-36019 is also significant because it allows the attacker to send a specially crafted URL to the target, resulting in the execution of malicious scripts in the victim's browser on their machine.
"An attacker could manipulate a malicious link, application, or file to disguise it as a legitimate link or file to trick the victim," Microsoft said in an advisory.
Microsoft's Patch Tuesday update also plugs three flaws in the Dynamic Host Configuration Protocol (DHCP) server service that could lead to a denial-of-service or information disclosure -
- CVE-2023-35638 (CVSS score: 7.5) - DHCP Server Service Denial-of-Service Vulnerability
- CVE-2023-35643 (CVSS score: 7.5) - DHCP Server Service Information Disclosure Vulnerability
- CVE-2023-36012 (CVSS score: 5.3) - DHCP Server Service Information Disclosure Vulnerability
The disclosure also comes as Akamai discovered a new set of attacks against Active Directory domains that use Microsoft Dynamic Host Configuration Protocol (DHCP) servers.
"These attacks could allow attackers to spoof sensitive DNS records, resulting in varying consequences from credential theft to full Active Directory domain compromise," Ori David said in a report last week. "The attacks don't require any credentials, and work with the default configuration of Microsoft DHCP server."
The web infrastructure and security company further noted the impact of the flaws can be significant as they can be exploited to spoof DNS records on Microsoft DNS servers, including an unauthenticated arbitrary DNS record overwrite, thereby enabling an actor to gain a machine-in-the-middle position on hosts in the domain and access sensitive data.
Microsoft, in response to the findings, said the "problems are either by design, or not severe enough to receive a fix," necessitating that users Disable DHCP DNS Dynamic Updates if not required and refrain from using DNSUpdateProxy.
Software Patches from Other Vendors
Outside of Microsoft, security updates have also been released by other vendors over the past few weeks to rectify several vulnerabilities, including —
- Adobe
- Amazon Web Services
- Android
- Apache Projects (including Apache Struts)
- Apple
- Arm
- Atlassian
- Atos
- Cisco
- CODESYS
- Dell
- Drupal
- F5
- Fortinet
- GitLab
- Google Chrome
- Google Chromecast
- Google Cloud
- Google Wear OS
- Hikvision
- Hitachi Energy
- HP
- IBM
- Jenkins
- Lenovo
- Linux distributions Debian, Oracle Linux, Red Hat, SUSE, and Ubuntu
- MediaTek (including 5Ghoul)
- Mitsubishi Electric
- Mozilla Firefox, Firefox ESR, and Thunderbird
- NETGEAR
- NVIDIA
- Qualcomm (including 5Ghoul)
- Samsung
- SAP
- Schneider Electric
- Siemens
- SolarWinds
- SonicWall
- Sophos (backports a fix for CVE-2022-3236 to unsupported versions of the Sophos Firewall)
- Spring Framework
- Veritas
- VMware
- WordPress
- Zoom, and
- Zyxel
(The story was updated after publication to modify the number of flaws patched by Microsoft and take into account CVE-2023-21751. Microsoft released an advisory for the vulnerability a day after the release of Patch Tuesday updates.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/12/microsofts-final-2023-patch-tuesday-33.html