Microsoft, Adobe fix zero-days exploited by attackers (CVE-2023-26369, CVE-2023-36761, CVE-2023-36802)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-26369 | Out-of-Bounds Write RCE in Adobe Acrobat and Reader via Malicious PDFs Adobe Acrobat and Reader contain an out-of-bounds write (CWE-787) memory-corruption vulnerability in the listed versions. The flaw is triggered by user interaction: a victim must open a malicious file (e.g., a crafted PDF) for exploitation to occur. Successful exploitation gives the attacker arbitrary code execution in the context of the current user. Anyone running affected versions of Acrobat, Acrobat DC, Acrobat Reader, or Acrobat Reader DC is exposed, and because Reader is the dominant PDF viewer, that spans effectively all unpatched desktops that open PDFs. The bug was exploited as a zero-day before being patched, was added to CISA's KEV catalog on 2023-09-14 with CISA warning of active attacks, and EPSS assigns a roughly 7% probability of exploitation in the next 30 days (94th percentile). Do: Upgrade all Acrobat and Reader installations to builds newer than 23.003.20284 and 20.005.30516/20.005.30514 per Adobe's security bulletin, as required by the CISA KEV listing (added 2023-09-14) which mandates applying vendor mitigations or discontinuing use. Until patched, caution users against opening PDFs from untrusted sources and consider blocking automatic PDF opening in browsers or email. Because the flaw was exploited as a zero-day, hunt for signs of compromise on endpoints that were running the affected versions. | 7.8 | 7% | KEV |
| masshundreds of millions of users (Acrobat/Reader is the world's dominant PDF viewer; effectively every unpatched desktop that opens PDFs) | |
| CVE-2023-29332 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability NVD description · AI analysis pending | 9.8 | 3% |
| — | ||
| CVE-2023-36757 | Microsoft Exchange Server Spoofing Vulnerability Microsoft Exchange Server Spoofing Vulnerability NVD description · AI analysis pending | 8.0 | 69% |
| — | ||
| CVE-2023-36761 | Information Disclosure Flaw in Microsoft Word Actively Exploited (CVE-2023-36761) CVE-2023-36761 is an information disclosure vulnerability in Microsoft Word caused by improper input validation (CWE-20). It is triggered when a user opens a specially crafted document, requiring user interaction but no authentication or special privileges, per the CVSS vector (AV:N/PR:N/UI:R). A successful attacker gains access to sensitive information from the affected system, with public reporting indicating the flaw can leak authentication material such as NTLM credentials. Anyone running affected versions of Word, including Word within Microsoft 365 Apps, Microsoft Office, and Office LTSC, is exposed, and the flaw was fixed in Microsoft's September 2023 Patch Tuesday updates. The vulnerability was exploited as a zero-day before patching: CISA added it to the Known Exploited Vulnerabilities catalog on September 12, 2023, and its EPSS score of 19.0% (97th percentile) signals elevated near-term exploitation risk. Do: Apply Microsoft's September 2023 security updates for Microsoft 365 Apps, Office, Office LTSC, and Word immediately, per vendor instructions and CISA KEV requirements. Until patched, treat unsolicited documents as untrusted and consider restricting outbound SMB/NTLM traffic to limit credential leakage. Given confirmed in-the-wild exploitation and no known public PoC, prioritize this KEV remediation and verify patch deployment across endpoints. | 6.5 | 20% | KEV |
| masshundreds of millions of users/devices (Word ships with Microsoft 365 and Office across enterprise and consumer fleets) | |
| CVE-2023-36802 | Use-After-Free Privilege Escalation in Microsoft Streaming Service Proxy CVE-2023-36802 is a use-after-free vulnerability (CWE-416) in the Microsoft Streaming Service Proxy, a component that ships with Windows, that allows an attacker to escalate privileges. It is triggered by a local attacker who can already execute code on a target machine and interacts with the streaming service proxy component in a way that mishandles freed memory. Successful exploitation typically yields elevated (SYSTEM/kernel-level) privileges, giving an attacker full control of the host and making it a common link in chained attack sequences alongside other exploits. Any Windows system carrying the affected component is potentially affected, which in practice means a very broad installed base of Windows client and server machines. The flaw is being actively exploited — CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-12 — though no public proof-of-concept is known and Microsoft's severity scoring was not yet available in the source data; EPSS estimates a high 27.5% chance of exploitation within 30 days (98th percentile). Do: Apply Microsoft's security updates for this vulnerability via the vendor's mitigation instructions (Windows Update/patch channel), as required by the CISA KEV listing, prioritizing internet-reachable and multi-user Windows hosts. Since exploitation requires local access, limit who can run code on Windows systems and review endpoints for signs of local privilege escalation activity; confirm the patch landed by checking installed updates against Microsoft's advisory. | 7.8 | 28% | KEV |
| mass≈hundreds of millions of Windows devices (the Streaming Service Proxy component ships with Windows, so exposure broadly mirrors the Windows install base) |
Full article700 words · extracted from helpnetsecurity.com · click to collapse
September 2023 Patch Tuesday is here, with fixes for actively exploited vulnerabilities in Adobe Acrobat and Reader (CVE-2023-26369), Microsoft Word (CVE-2023-36761), and Microsoft Streaming Service Proxy (CVE-2023-36802).
Microsoft vulnerabilities of note
Microsoft has delivered fixes for 61 CVE-numbered flaws: 5 critical, 55 important, and one of moderate severity.
Patches for CVE-2023-36761, an information disclosure bug affecting Word, should be quickly deployed, since Microsoft Threat Intelligence detected its exploitation by attackers (though the company did not say how widespread the attacks are).
“Exploitation of this vulnerability is not just limited to a potential target opening a malicious Word document, as simply previewing the file can cause the exploit to trigger. Exploitation would allow for the disclosure of New Technology LAN Manager (NTLM) hashes,” says Satnam Narang, senior staff research engineer at Tenable.
Tom Bowyer, Manager, Product Security at Automox, notes that exposed NTLM hashes pose significant risks, as they are essentially digital keys to a user’s credentials. “If a malicious actor gains access to these hashes, they can potentially impersonate the user, gaining unauthorized access to sensitive data and systems. They could also conduct pass-the-hash attacks, where the attacker uses the hashed version of a password to authenticate themselves without needing to decrypt it.”
CVE-2023-36802, an elevation of privilege flaw in the Microsoft Streaming Service Proxy, has also been exploited in the wild. No additional details about the attacks leveraging it have been shared, but Microsoft acknowledged DBAPPSecurity WeBin Lab and IBM X-Force researchers for flagging it, as well as its own Threat Intelligence and Security Response Center teams.
Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, has also singled out CVE-2023-29332, a bug in Azure Kubernetes service that could allow a remote, unauthenticated attacker to gain Cluster Administration privileges, as important to patch.
“We’ve seen bugs like this before, but this one stands out as it can be reached from the Internet, requires no user interaction, and is listed as low complexity. Microsoft gives this an ‘Exploitation Less Likely’ rating, but based on the remote, unauthenticated aspect of this bug, this could prove quite tempting for attackers,” he explained.
There are also many bugs fixed in the Visual Studio integrated development environment this time around, allowing either remote code execution denial of service, or elevation of privilege.
“Remote code execution and elevation of privilege vulnerabilities in Visual Studio pose a real and substantial danger. This type of vulnerability can give an attacker the ability to run malicious code on your system, potentially gaining full control over the affected environment,” Bowyer commented.
“In the worst-case scenario, this could mean the theft or corruption of proprietary source code, the introduction of backdoors, or malicious tampering that could turn your application into a launchpad for attacks on others.”
Finally, Microsoft Exchange server got a bunch fixes, including for CVE-2023-36757, a spoofing vulnerability. Well, to be more precise, the fix for that and other Exchange flaws have been included in last month’s Exchange security updates.
“The CVEs released today were actually addressed in the August 2023 Exchange Server Security Update (SU),” Microsoft explained.
“Due to the timing of validation of those fixes and release dates, we decided to release the CVEs as a part of September 2023 ‘Patch Tuesday’ release cycle. We know that many customers are accustomed to checking for Microsoft security releases on the second Tuesday of every month, and we did not want these CVEs to go unnoticed. There is no separate Exchange Server SU for September 2023. If you have not yet installed the August 2023 SU, please do so now.”
Childs pointed out that CVE-2023-36757, along with the three RCE bugs, require authentication, but also that last month’s Exchange patches included an authentication bypass flaw.
Critical Adobe patches
Just like Microsoft, Adobe pushes out regular security updates on the second Tuesday of every month, and this time they are for Acrobat and Reader, Experience Manager, and Connect.
But only the former updates should be urgently installed, as they fix a critical out-of-bounds write flaw (CVE-2023-26369) that can lead to arbitrary code execution and “has been exploited in the wild in limited attacks targeting Adobe Acrobat and Reader.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/09/12/microsoft-adobe-fix-zero-days-exploited-by-attackers-cve-2023-26369-cve-2023-36761-cve-2023-36802/