Microsoft fixes exploited WordPad, Skype for Business zero-days (CVE-2023-36563, CVE-2023-41763)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-35349 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 3% |
| — | ||
| CVE-2023-36563 | Information Disclosure in Microsoft WordPad Exploited in the Wild CVE-2023-36563 is an information disclosure flaw (CWE-20, improper input validation) in Microsoft WordPad, the lightweight word processor bundled with supported Windows releases; Microsoft has published limited technical detail and CISA describes the flaw as unspecified. An attacker triggers it by persuading a user to open a specially crafted document in WordPad, where improper handling of the document content (including URL/remote-resource references) causes information to be disclosed to the attacker. A successful attacker gains access to sensitive information from the affected system rather than code execution, and exploitation requires user interaction with a malicious file. Any Windows installation with WordPad is potentially affected, making the population essentially the entire supported Windows installed base. Exploitation is confirmed: CISA added the flaw to its KEV catalog on 2023-10-10 and its advisory notes no public proof-of-concept is known and ransomware use is unknown; EPSS is 20.7% (97th percentile), indicating elevated near-term exploitation likelihood. Do: Apply Microsoft's October 10, 2023 Windows security updates, which include the WordPad fix, prioritizing systems where users open untrusted documents; until patched, follow Microsoft's mitigation guidance to disable the WordPad URL protocol handler via the published registry change. Note that WordPad has since been removed entirely in Windows 11 24H2, so those systems are no longer exposed; per CISA, any ransomware linkage is unknown. | 5.5 | 21% | KEV |
| mass≈1.4 billion Windows devices (WordPad ships by default with Windows) | |
| CVE-2023-36778 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.0 | 4% |
| — | ||
| CVE-2023-41763 | Unauthenticated SSRF/Elevation-of-Privilege Flaw in Microsoft Skype for Business Server CVE-2023-41763 is a vulnerability in Microsoft Skype for Business Server that Microsoft classifies as an elevation-of-privilege issue, with the underlying weakness mapped to CWE-918 (server-side request forgery). The CVSS vector (AV:N/AC:L/PR:N/UI:N, scope unchanged) shows it can be triggered remotely by an unauthenticated attacker sending crafted network requests, and the impact is confined to confidentiality, meaning an attacker can potentially obtain limited sensitive information from the affected server. Any organization running on-premises Skype for Business Server is potentially affected; the source data does not specify the affected version ranges. The flaw was patched in Microsoft's October 2023 Patch Tuesday, where it was fixed alongside the actively exploited WordPad zero-day (CVE-2023-36563), and it was added to CISA's Known Exploited Vulnerabilities catalog on October 10, 2023, carrying a 90.4% EPSS probability of exploitation within 30 days. Do: Apply Microsoft's October 2023 Patch Tuesday security updates for Skype for Business Server immediately; CISA's KEV required action is to apply vendor mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. No public proof-of-concept is known, but exploitation is confirmed in the wild, so prioritize internet-facing deployments and review Skype for Business web-service logs for anomalous requests. Check which Skype for Business Server versions your organization runs against Microsoft's advisory to confirm patch applicability. | 5.3 | 90% | KEV |
| massplausibly >1 million users across tens of thousands of on-premises server deployments (estimate) | |
| CVE-2023-44487 | Rapid Reset Denial-of-Service in HTTP/2 (CWE-400 Resource Exhaustion) CVE-2023-44487 is a flaw in the HTTP/2 protocol's stream handling (CWE-400, uncontrolled resource consumption) in which a client opens a large number of streams and immediately cancels them with RST_STREAM frames, forcing the server to repeatedly allocate and tear down per-stream state. When this 'rapid reset' pattern is driven at high volume from many sources, it exhausts server CPU and memory, producing a distributed denial-of-service; Google, Cloudflare and AWS all reported record-scale attacks using this technique. The only impact is availability (denial of service), not code execution or data exposure, but any system speaking HTTP/2 is in scope, including web servers, load balancers, API gateways and CDN edges, and client-side implementations are also affected in a reverse-direction variant. Because the weakness is in the protocol specification itself (attributed to IETF HTTP/2), virtually every deployment with HTTP/2 enabled is affected until vendors ship mitigations or patches. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-10-10, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Apply mitigations per vendor instructions as required by CISA KEV/BOD 22-01 guidance — most major web server, load balancer, and CDN vendors have shipped patches or tuning knobs, so check and update each HTTP/2-facing component in your estate. Where patching is not yet possible, limit the number of concurrent HTTP/2 streams per connection, rate-limit new stream creation and inbound HTTP/2 connections, or disable HTTP/2 on internet-exposed servers. Confirm with your CDN or cloud provider that rapid-reset DDoS mitigations are in place at the edge. | 7.5 | 100% | KEV |
| massmillions of servers and network edges (HTTP/2 is negotiated on a large share of HTTPS-capable hosts in public internet scans) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | asp.net | cts: Windows 10 and 11; Windows Server 2016, 2019 and 2022; ASP.NET Core 7.0; Microsoft Visual Studio 2022, .NET 6.0 and 7.0; a |
Full article474 words · extracted from helpnetsecurity.com · click to collapse
On this October 2023 Patch Tuesday, Microsoft has released 103 patches and has fixed three actively exploited vulnerabilities (CVE-2023-36563, CVE-2023-41763, CVE-2023-44487).
The exploited zero-days (CVE-2023-36563, CVE-2023-41763, CVE-2023-44487)
CVE-2023-36563, discovered by Microsoft Threat Intelligence, is a WordPad vulnerability that could allow attackers to grab NTLM hashes (i.e., encrypted user passwords on Windows systems).
“To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. Additionally, an attacker could convince a local user to open a malicious file,” Microsoft explained.
Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, notes that in addition to applying the patch for CVE-2023-36563, admins should consider blocking outbound NTLM over SMB on Windows 11, to “significantly hamper NTLM-relay exploits.”
CVE-2023-41763 can be exploited by an attacker by making a specially crafted network call to the target Skype for Business server, which could cause the parsing of an HTTP request made to an arbitrary address, and the attacker gleaning IP addresses and/or port numbers.
“In some cases, the exposed sensitive information could provide access to internal networks,” says Microsoft, and that’s why it categorizes the flaw as an elevation of privilege vulnerability.
CVE-2023-44487 is a vulnerability in the HTTP/2 protocol, which has been exploited by attackers to mount massive, high-volume DDoS attacks in August 2023.
Microsoft has provided patches for its affected products: Windows 10 and 11; Windows Server 2016, 2019 and 2022; ASP.NET Core 7.0; Microsoft Visual Studio 2022, .NET 6.0 and 7.0; and ASP.NET Core 6.0.
Possible workarounds have also been detailed, but Microsoft advises customers that are self-hosting web applications to patch web servers/proxies as quickly as possible to protect their environments.
Other vulnerabilities of note, and the phasing out of VBScript
Childs deems that CVE-2023-35349, a remote code execution (RCE) bug in Microsoft Message Queuing, is wormable, since exploitation requires no authentication nor user interaction, and can be performed by a remote attacker. “You should definitely check your systems to see if [Message Queuing is] installed and also consider blocking TCP port 1801 at your perimeter,” he advises.
This month, there’s one fixed Exchange Server bug (CVE-2023-36778), that could be exploited to achieve remote code execution via a PowerShell remoting session. But to do that, the attacker must be authenticated with LAN-access and have credentials for a valid Exchange user.
The Exchange team has also published a blog post that organizations running on-prem Exchange servers or Exchange Management tools workstations should peruse.
Finally, as a sidenote, Microsoft announced today that VBScript, which is often exploited for malware distribution, is being deprecated.
“In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system,” the company said.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/10/10/cve-2023-36563-cve-2023-41763/