Microsoft patches zero-day exploited by attackers (CVE-2023-28252)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2013-3900 | Authenticode Signature Verification Flaw in Microsoft WinVerifyTrust (RCE) Microsoft's WinVerifyTrust function improperly validates Windows Authenticode signatures on portable executable (PE) files, allowing crafted modifications to a signed binary — such as altered sections or checksum-table manipulation — to still pass signature verification. An attacker who tampers with a legitimately signed executable can distribute modified files that Windows and dependent security controls treat as authentic, gaining the trust of a valid digital signature and, ultimately, remote code execution in contexts that rely on signature checks. Any Microsoft Windows platform performing Authenticode verification through WinVerifyTrust is affected; the source data does not list specific Windows version ranges, but because WinVerifyTrust is core Windows functionality the exposure is very broad. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-10, indicating confirmed in-the-wild exploitation, and EPSS puts its 30-day exploitation probability at about 44.6% (99th percentile), though no public PoC is known. Do: Apply Microsoft's updates for CVE-2013-3900 across all Windows systems per vendor instructions, as required for CISA KEV entries. Where supported, enable Microsoft's stricter certificate padding check (EnableCertPaddingCheck) per Microsoft guidance to harden signature verification against this bypass. Prioritize patching endpoints and servers that execute or validate downloaded, emailed, or otherwise externally sourced signed binaries, given confirmed exploitation and high EPSS. | — | 45% | KEV |
| masshundreds of millions of Windows devices (near-universal across the Windows installed base) | |
| CVE-2023-21554 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 group max | 95% |
| — | ||
| CVE-2023-23376 | Out-of-Bounds Write Privilege Escalation in Microsoft Windows CLFS Driver CVE-2023-23376 is a heap-based buffer overflow (out-of-bounds write, CWE-122/CWE-787) in the Windows Common Log File System (CLFS) kernel driver. A local attacker with low privileges can trigger the flaw when the driver mishandles CLFS log-file data, with no user interaction required. Successful exploitation elevates the attacker from a low-privileged user to SYSTEM/kernel-level privileges, which is why ransomware operators chain it with other bugs after gaining an initial foothold. All supported Windows 10 (1507, 1607, 1809, 20H2, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server 2008, 2012, 2016, and 2019 releases as of February 2023 are affected. The flaw is actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on February 14, 2023 with known ransomware use, Microsoft shipped the fix in the February 2023 Patch Tuesday release, and EPSS estimates roughly an 11% probability of exploitation within the next 30 days (96th percentile). Do: Apply the Microsoft security updates released on February 14, 2023 (February Patch Tuesday) to every Windows 10, Windows 11, and Windows Server system in the affected version list, prioritizing servers and endpoints exposed to ransomware-prone environments. Verify patch status via update history or vulnerability scanning, since exploitation requires only local low-privileged access and there is no substitution for patching. Given confirmed ransomware chaining, also hunt for signs of post-compromise privilege escalation on hosts that were unpatched before mid-February 2023. | 7.8 | 11% | KEV ransomware |
| mass~1 billion+ Windows devices (the CLFS driver ships in every listed Windows 10/11 client and Windows Server 2008-2019 release) | |
| CVE-2023-28250 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation CVE-2023-28252 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Common Log File System (CLFS) driver that allows privilege escalation. The flaw is triggered when the kernel's CLFS driver processes malformed or maliciously crafted log file data, corrupting heap memory; an attacker who can already run code on a target system (e.g., a low-privileged user or an attacker chained with another flaw such as a remote code execution bug) can leverage it to gain SYSTEM-level privileges. Because the CLFS driver ships with supported Windows client and server releases, essentially the entire Windows installed base is potentially exposed. The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2023-04-11 with known ransomware use, and EPSS estimates a 49.0% probability of exploitation within 30 days (99th percentile). It was addressed in Microsoft's April 2023 security updates, and the required remediation action is to apply the vendor updates. Do: Apply Microsoft's April 2023 (or later) cumulative security updates to all Windows clients and servers per vendor instructions, prioritizing high-value and domain infrastructure systems given the known ransomware use; there is no public PoC or known workaround, so patching is the primary mitigation. Note that this is a local elevation-of-privilege flaw, so also hunt for prior low-privilege access or exploitation chains on hosts, and confirm remediation by checking installed update levels across the estate. | 7.8 | 49% | KEV ransomware PoC |
| masshundreds of millions of Windows devices (the CLFS driver is present across essentially all modern Windows 10/11 and Windows Server installations) |
Full article840 words · extracted from helpnetsecurity.com · click to collapse
It’s April 2023 Patch Tuesday, and Microsoft has released fixes for 97 CVE-numbered vulnerabilities, including one actively exploited zero-day (CVE-2023-28252).
About CVE-2023-28252
CVE-2023-28252 is a vulnerability in the Windows Common Log File System (CLFS) that allows attackers to gain SYSTEM privileges on target machines.
“Over the last two years, attackers appear to have found success targeting CLFS in order to elevate privileges as part of post-compromise activity,” Satnam Narang, senior staff research engineer at Tenable, told Help Net Security.
“CVE-2023-28252 is the second CLFS elevation of privilege zero-day exploited in the wild this year (the first one was CVE-2023-23376, patched in February) and the fourth in the last two years. It is also the second CLFS zero-day disclosed to Microsoft by researchers from Mandiant and DBAPPSecurity, though it is unclear if both of these discoveries are related to the same attacker.”
Dustin Childs, head of threat awareness at Trend Micro Inc.’s Zero Day Initiative, has posited that the February fix might have been insufficient and that attackers may have found a method to bypass that fix – though there’s not enough information available to confirm this.
“This type of exploit is typically paired with a code execution bug to spread malware or ransomware. Definitely test and deploy this patch quickly,” he added.
Other vulnerabilities of note
CVE-2023-21554 is a critical remote code execution vulnerability in the Microsoft Message Queuing service (an optional Windows component available on all Windows operating systems). It can be triggered with a specially crafted malicious MSMQ packet sent to a MSMQ server.
Dubbed QueueJumper, it’s one of the three vulnerabilities found by the Check Point principal vulnerability researcher Haifei Li and Wayne Low of Fortinet’s FortiGuard Lab: the other two are CVE-2023-21769 and CVE-2023-28302, which can only result in a denial of service condition.
“This unauthorized RCE bug (CVE-2023-21554) in the ‘forgotten’ MSMQ service may have big impact. If you’re a Windows admin, you need to check your environments ASAP (you may have unawarely enabled the service),” Li explained.
“It’s a simple bug, unauthorized – anyone who could reach to 1801/TCP will be able to trigger the bug with a single packet. So patch patch! and check your firewalls to block untrusted connections!”
Li also shared that during their research, they found over 360,000 Internet-facing IPs running the MSMQ service and the 1801 port open to the Internet. Also, that “when installing the official Microsoft Exchange Server, the setup wizard app would enable the MSMQ service in the background if the user selects the ‘Automatically install Windows Server roles and features that are required to install Exchange’ option, which is recommended by Microsoft.”
Check Point research will release technical details about the vulnerabilities later this month so that admins have time to implement the patches or a workaround: blocking inbound connections to the 1801/TCP port from untrusted sources.
Microsoft has also fixed CVE-2023-28250, a critical RCE in the Pragmatic General Multicast protocol installed with the MSMQ service. “When the Windows Message Queuing service is enabled, an attacker who successfully exploited this vulnerability could send a specially crafted file over the network to achieve remote code execution and attempt to trigger malicious code,” the company noted.
Childs also made sure to point out Microsoft’s republishing of CVE-2013-3900, an old WinVerifyTrust Signature Validation vulnerability that has recently been exploited by attackers in the 3CX supply chain attack.
The fix for it is still optional and includes setting a key in the system registry.
“An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system,” Microsoft noted, and said it does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows.
“The new stricter verification behavior, when enabled, applies primarily to portable executable (PE) binaries that are signed with the Windows Authenticode signature format. Binaries most likely to be affected are PE installer files distributed via the Internet that are customized at time of download. The most common scenario in which users could perceive an impact is during the downloading and installation of new applications. This is the case only if customers have chosen to enable the stricter verification behavior, after which users may observe warning messages when attempting to install new applications with signatures that fail validation.”
UPDATE (April 12, 2023, 04:10 a.m. ET):
CVE-2023-28252 is being exploited by a sophisticated cybercrime group that attempts to deliver the Nokoyawa ransomware.
“This group is notable for its use of a large number of similar but unique Common Log File System (CLFS) driver exploits that were likely developed by the same exploit author. Since at least June 2022, we’ve identified five different exploits used in attacks on retail & wholesale, energy, manufacturing, healthcare, software development and other industries,” says Kaspersky researcher Boris Larin.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/04/11/cve-2023-28252/