Microsoft Patches Two Zero Days This Month

Microsoft has set over 80 vulnerabilities in this month’s Patch Tuesday update spherical, like two zero times staying actively exploited in the wild.

One particular of those people is CVE-2023-23397, a critical elevation of privilege bug in Outlook with a CVSS score of 9.8.

“The attack can be executed without any person conversation by sending a specifically crafted email which triggers routinely when retrieved by the email server. This can direct to exploitation ahead of the email is even viewed in the Preview Pane,” discussed Action1 VP of vulnerability and menace exploration, Mike Walters.

“If exploited successfully, an attacker can accessibility a user’s Net-NTLMv2 hash, which can be utilized to execute a go-the-hash attack on another support and authenticate as the user.”

The bug was claimed by the Computer Unexpected emergency Reaction Crew for Ukraine (CERT-UA), hinting that it was getting actively exploited by Russian threat actors.

Read far more about Russia’s cyber-offensive in Ukraine: Microsoft: Russia Has Released Hundreds of Cyber Functions in Ukraine

The 2nd zero working day, CVE-2023-24880, is a security characteristic bypass in Windows SmartScreen.

It allows attackers to craft a destructive file able of circumventing Mark-of-the-Web (MOTW) defenses in features like Protected Watch in Business office, in accordance to Microsoft.

“This CVE influences all now supported versions of the Windows OS,” explained Ivanti VP of security products, Chris Goettl. “The CVSS score is only 5.4, which may possibly avoid observe by a lot of companies and on its possess this CVE may well not be all that threatening, but it was probable utilized in an attack chain with supplemental exploits. Prioritizing this month’s OS update would cut down the risk to your corporation.”

Of the nine critical CVEs outlined this month, CVE-2023-21708 must also be a precedence for security teams, argued Gal Sadeh, head of facts and security investigate at Silverfort. It refers to a remote code execution bug in Distant Treatment Get in touch with Runtime that will allow unauthenticated attackers to operate remote commands on a goal device.

“Threat actors could use this to attack domain controllers, which are open by default,” he included. “To mitigate, we advise area controllers only let RPC from licensed networks and RPC visitors to avoidable endpoints and servers is restricted.”

Some parts of this article are sourced from:
www.infosecurity-magazine.com