Microsoft Releases Patches for 74 New Vulnerabilities in August Update

Microsoft has patched a complete of 74 flaws in its program as portion of the firm’s Patch Tuesday updates for August 2023, down from the voluminous 132 vulnerabilities the organization set previous thirty day period.

This comprises 6 Critical and 67 Crucial security vulnerabilities. Also released by the tech big are two protection-in-depth updates for Microsoft Place of work (ADV230003) and the Memory Integrity System Readiness Scan Tool (ADV230004).

This is in addition to 31 issues tackled by Microsoft in its Chromium-based Edge browser considering that past month’s Patch Tuesday edition and 1 facet-channel flaw impacting sure processor versions provided by AMD (CVE-2023-20569 or Inception).

ADV230003 fears an previously regarded security flaw tracked as CVE-2023-36884, a distant code execution vulnerability in Place of work and Windows HTML that has been actively exploited by the Russia-connected RomCom menace actor in attacks concentrating on Ukraine as properly as pro-Ukraine targets in Japanese Europe and North The usa.

Microsoft claimed that installing the most up-to-date update “stops the attack chain” major to the distant code execution bug.

The other defense-in-depth update for the Memory Integrity Technique Readiness scan tool, which is used to test for compatibility issues with memory integrity (aka hypervisor-protected code integrity or HVCI), will take treatment of a publicly recognized bug wherein the “initial variation was posted with no a RSRC area, which includes source info for a module.”

Also patched by the tech big are various distant code execution flaws in Microsoft Information Queuing (MSMQ) and Microsoft Groups as effectively as a number of spoofing vulnerabilities in Azure Apache Ambari, Azure Apache Hadoop, Azure Apache Hive, Azure Apache Oozie, Azure DevOps Server, Azure HDInsight Jupyter, and .NET Framework.

On major of that, Redmond has resolved 6 denial-of-service (DoS) and two data disclosure flaws in MSMQ, and follows a range of other troubles discovered in the exact provider that could final result in remote code execution and DoS.

3 other vulnerabilities of take note are CVE-2023-35388, CVE-2023-38182 (CVSS scores: 8.), and CVE-2023-38185 (CVSS score: 8.8) – remote code execution flaws in Exchange Server – the initial two of which have been tagged with an “Exploitation More Very likely” evaluation.

“The exploitation of CVE-2023-35388 and CVE-2023-38182 is somewhat restricted due to the fact of the have to have for an adjacent attack vector and legitimate exchange qualifications,” Natalie Silva, lead content material engineer at Immersive Labs, reported.

“This usually means the attacker wants to be related to your interior network and be ready to authenticate as a legitimate Trade consumer in advance of they can exploit these vulnerabilities. Any person who achieves this can carry out distant code execution using a PowerShell remoting session.”

Microsoft additional acknowledged the availability of a proof-of-idea (PoC) exploit for a DoS vulnerability in .NET and Visual Studio (CVE-2023-38180, CVSS rating: 7.5), noting that the “code or system is not purposeful in all conditions and could require substantial modification by a skilled attacker.”

Last of all, the update also features patches for 5 privilege escalation flaws in the Windows Kernel (CVE-2023-35359, CVE-2023-35380, CVE-2023-35382, CVE-2023-35386, and CVE-2023-38154, CVSS scores: 7.8) that could be weaponized by a menace actor with area accessibility to the concentrate on device to gain Method privileges.

Software program Patches from Other Sellers

In addition to Microsoft, security updates have also been introduced by other sellers in excess of the past numerous weeks to rectify several vulnerabilities, including —

• Adobe
• AMD
• Android
• Apache Initiatives
• Aruba Networks
• Cisco
• Citrix
• CODESYS
• Dell
• Drupal
• F5
• Fortinet
• GitLab
• Google Chrome
• Hitachi Electricity
• HP
• IBM
• Intel
• Ivanti
• Jenkins
• Lenovo
• Linux distributions Debian, Oracle Linux, Pink Hat, SUSE, and Ubuntu
• MediaTek
• Mitsubishi Electric
• Mozilla Firefox, Firefox ESR, and Thunderbird
• NVIDIA
• PaperCut
• Qualcomm
• Samba
• Samsung
• SAP
• Schneider Electric powered
• Siemens
• SolarWinds
• Splunk
• Synology
• Craze Micro
• Veritas
• VMware
• Zimbra
• Zoho ManageEngine
• Zoom, and
• Zyxel

Discovered this posting attention-grabbing? Adhere to us on Twitter  and LinkedIn to browse more exceptional written content we put up.

Some parts of this article are sourced from:
thehackernews.com