Microsoft Patches 80+ Flaws Including Two Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-21709 | Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2023-29328 +1 in the same advisory: …29330 | Microsoft Teams Remote Code Execution Vulnerability Microsoft Teams Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 2% |
| — | ||
| CVE-2023-35385 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2023-36884 | Race Condition RCE in Microsoft Windows Search CVE-2023-36884 is a race condition (TOCTOU) vulnerability in Microsoft Windows Search that permits remote code execution, rated 7.5 (high) on CVSS 3.1. It is triggered over the network with user interaction — for example, when a user opens or interacts with a specially crafted document that causes the vulnerable search code path to race, allowing arbitrary code execution in the context of the current user. An attacker gains code execution on the victim's Windows system, which the RomCom threat actor chained with Firefox flaws to deploy backdoors against political targets, and CISA notes known ransomware use. Virtually every supported Windows client and server release at the time is affected, spanning Windows 10 1507 through 22H2, Windows 11 21H2/22H2, and Windows Server 2008 through 2022. The flaw was actively exploited as a zero-day before being fixed in the July 2023 Patch Tuesday; it was added to the CISA KEV catalog on 2023-07-17 and carries a 98.9% EPSS score (100th percentile). Do: Apply the July 2023 Patch Tuesday Windows security updates to all Windows 10, Windows 11, and Windows Server systems, prioritizing high-value and frequently attacked endpoints since the bug was exploited as a zero-day by RomCom and carries a KEV deadline (US civilian agencies were directed to remediate by August 1, 2023). Because exploitation requires user interaction, caution users against opening untrusted documents, and verify patch status via your patch management or vulnerability scanner against the KEV requirement. If patching is not possible, follow vendor mitigations per CISA's required action or discontinue use. | 7.5 | 99% | KEV ransomware |
| mass≈1 billion+ Windows devices (Windows 10/11 installed base) plus the enterprise Windows Server estate | |
| CVE-2023-36910 +1 in the same advisory: …36911 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 3% |
| — | ||
| CVE-2023-38180 | Unauthenticated DoS in Microsoft .NET, ASP.NET Core and Visual Studio 2022 CVE-2023-38180 is a denial-of-service vulnerability in Microsoft .NET and Visual Studio 2022 caused by uncontrolled resource consumption (CWE-400). Per the CVSS vector, a remote, unauthenticated attacker can trigger it over the network with no privileges or user interaction required, causing affected applications or services to exhaust resources and become unavailable. The attacker gains only availability impact (high availability severity, no confidentiality or integrity impact), but this can take down ASP.NET Core web applications and other .NET-based services. Any organization running vulnerable .NET runtimes, ASP.NET Core applications, or Visual Studio 2022 is exposed, and Fedora also ships affected .NET packages. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-08-09, it was among the two actively exploited flaws fixed in Microsoft's August 2023 Patch Tuesday, and EPSS assigns a 14.0% 30-day exploitation probability (96th percentile). Do: Apply the August 2023 Microsoft security updates for all affected .NET, ASP.NET Core, and Visual Studio 2022 versions listed in Microsoft's advisory, and install the updated .NET packages on Fedora; because this flaw is in CISA's KEV catalog, the required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. After updating, rebuild or restart .NET applications so they run on the patched runtime, and monitor internet-facing .NET services for signs of resource-exhaustion denial-of-service. No public proof-of-concept is known, but active exploitation has been reported, so patching should be treated as urgent. | 7.5 | 14% | KEV |
| masshundreds of millions of potential installations (ubiquity of the .NET runtime and ASP.NET Core in server and web deployments) |
Full article372 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft released updates for 87 vulnerabilities yesterday, including two that are being actively exploited in the wild.
The first zero-day was publicly disclosed in last month’s Patch Tuesday, according to Tenable senior staff research engineer, Satnam Narang.
"Last month, Microsoft initially announced a series of zero-day vulnerabilities in a variety of Microsoft products that were discovered and exploited in the wild. They were assigned a single placeholder: CVE-2023-36884,” he explained.
“This month, Microsoft released patches for this vulnerability, calling it a Windows Search Security Feature Bypass Vulnerability and also released ADV230003, a defense-in-depth update designed to stop the attack chain associated that leads to the exploitation of this CVE.”
Narang urged organizations to prioritize the patch and defense-in-depth update, given this vulnerability has already been exploited in attacks.
Read more on Microsoft zero days: Microsoft Fixes Zero-Day Bug This Patch Tuesday
The second zero-day is CVE-2023-38180; a denial of service bug in .NET and Visual Studio which could cause systems to crash.
“It utilizes a network attack vector, has a low complexity of attack, and doesn’t necessitate privileges or user interaction,” said Action1 co-founder, Mike Walters. “Its CVSS rating is 7.5, which isn’t categorized as high due to its sole ability to result in a denial of service.”
Elsewhere, experts urged sysadmins to look at one of six critical CVEs in this month’s update round.
CVE-2023-21709 is an elevation of privilege vulnerability in Microsoft Exchange Server with a CVSS score of 9.8. The attack complexity is low and it doesn’t require any user interaction, making it a potentially popular choice for threat actors.
There were also over 20 remote code execution (RCE) bugs listed by Microsoft this month.
These include CVE-2023-29328 and CVE-2023-29330, two critical vulnerabilities in Microsoft Teams which can be exploited by an attacker with direct access to a targeted device. For exploitation, the user must join a Teams meeting organized by the attacker, Walters explained.
CVE-2023-36911, CVE-2023-36910, and CVE-2023-35385 are all RCE flaws in the Microsoft Message Queuing Service which have a CVSS score of 9.8 but a low likelihood of exploitation.
“All three have a network attack vector, low complexity of attack, require no privileges, and do not need user interaction,” said Walters.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-patches-80-flaws-two/