Microsoft Fixes Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-21554 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 95% |
| — | ||
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation CVE-2023-28252 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Common Log File System (CLFS) driver that allows privilege escalation. The flaw is triggered when the kernel's CLFS driver processes malformed or maliciously crafted log file data, corrupting heap memory; an attacker who can already run code on a target system (e.g., a low-privileged user or an attacker chained with another flaw such as a remote code execution bug) can leverage it to gain SYSTEM-level privileges. Because the CLFS driver ships with supported Windows client and server releases, essentially the entire Windows installed base is potentially exposed. The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2023-04-11 with known ransomware use, and EPSS estimates a 49.0% probability of exploitation within 30 days (99th percentile). It was addressed in Microsoft's April 2023 security updates, and the required remediation action is to apply the vendor updates. Do: Apply Microsoft's April 2023 (or later) cumulative security updates to all Windows clients and servers per vendor instructions, prioritizing high-value and domain infrastructure systems given the known ransomware use; there is no public PoC or known workaround, so patching is the primary mitigation. Note that this is a local elevation-of-privilege flaw, so also hunt for prior low-privilege access or exploitation chains on hosts, and confirm remediation by checking installed update levels across the estate. | 7.8 | 49% | KEV ransomware PoC |
| masshundreds of millions of Windows devices (the CLFS driver is present across essentially all modern Windows 10/11 and Windows Server installations) |
Full article357 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft’s Patch Tuesday release this month included a security update for a Windows zero-day vulnerability being actively exploited in the wild.
The bug in question, CVE-2023-28252, is described as an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver.
No proof of concept has been discovered for the exploit as yet, so Microsoft customers should patch immediately, advised Mike Walters, VP of vulnerability and threat research at Action1.
“This vulnerability has a low complexity and uses a local attack vector, requiring only low privileges to exploit and no interaction from the user. It affects Windows Server versions from 2008 onward, as well as all versions of Windows 10,” he explained.
“The vulnerability has a CVSS risk score of 7.8, which is lower because it can only be executed locally. However, it still poses a high privilege escalation risk because an attacker who successfully exploits it can gain system privileges.”
Dustin Childs, head of threat awareness at the Zero Day Initiative, added that a similar zero-day was patched in the same Windows component just two months ago.
“To me, that implies the original fix was insufficient and attackers have found a method to bypass that fix,” he added.
“As in February, there is no information about how widespread these attacks may be. This type of exploit is typically paired with a code execution bug to spread malware or ransomware. Definitely test and deploy this patch quickly.”
There were updates for a total of seven vulnerabilities rated critical, including CVE-2023-21554, a remote code execution bug in Microsoft Message Queuing which was given a CVSS rating of 9.8.
“It allows a remote, unauthenticated attacker to run their code with elevated privileges on affected servers with the Message Queuing service enabled. This service is disabled by default but is commonly used by many contact center applications,” explained Childs.
“It listens to TCP port 1801 by default, so blocking this at the perimeter would prevent external attacks. However, it’s not clear what impact this may have on operations. Your best option is to test and deploy the update.”
Editorial image credit: rafapress / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-fixes-zeroday-bug-patch/