Microsoft Security Update: Addressing 58 Vulnerabilities and 5 Zero-Days

In November, Microsoft released patches to address a mix of vulnerabilities across its software suite. This included 5 zero-day vulnerabilities that were actively exploited, categorized as follows:

• Critical: 3 vulnerabilities
• Important: 56 vulnerabilities
• Moderate: 4 vulnerabilities

Zero-Day Vulnerabilities: A Closer Look

CVE-2023-36025: Windows SmartScreen Security Feature Bypass Vulnerability

• CVSSv3 Score: 8.8
• Impact: Allows bypassing Windows Defender SmartScreen checks.
• Context: Third zero-day related to Windows SmartScreen in 2023.

CVE-2023-36033: Windows DWM Core Library Elevation of Privilege Vulnerability

• CVSSv3 Score: 7.8
• Impact: Risk of attacker acquiring SYSTEM privileges.

CVE-2023-36036: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• CVSSv3 Score: 7.8
• Impact: Similar to CVE-2023-36033, elevating attacker privileges.

CVE-2023-36038: ASP.NET Core Denial of Service Vulnerability

• CVSSv3 Score: 8.2
• Impact: Exploitable via HTTP requests to .NET 8 RC 1 running on IIS InProcess hosting model.

CVE-2023-36413: Microsoft Office Security Feature Bypass Vulnerability

• CVSSv3 Score: 6.5
• Impact: Bypassing Office Protected View, requiring user action to open a malicious file.

Additional Considerations

• Threat Actors: No specific information on the attackers exploiting these vulnerabilities.
• CISA Advisory: Urgent patching advised, with a deadline set for December 5, 2023.

Addressing Critical Flaws

High-Risk Vulnerabilities

• CVE-2023-36052: Azure CLI REST Command Information Disclosure Vulnerability, with a CVSSv3 Score of 8.6.
• CVE-2023-36397: Windows PGM Remote Code Execution Vulnerability, with a CVSSv3 Score of 9.8.
• CVE-2023-36400: Windows HMAC Key Derivation Elevation of Privilege Vulnerability, with a CVSSv3 Score of 8.8.

Nature of the Flaws

1. Azure CLI Vulnerability: Risk of extracting plaintext passwords and usernames from log files.
2. Windows HMAC Key Derivation: Attacker gains SYSTEM privileges through a crafted application.
3. Windows PGM Remote Code Execution: Exploitable via Windows message queuing service, leading to remote code execution.

Recommendations for Users

The primary recommendation for users and administrators is to install the latest security updates from Microsoft. These updates are crucial in mitigating the potential threats posed by these vulnerabilities. Regular system monitoring and adherence to security best practices are also recommended to further safeguard against potential exploits.

Conclusion and Final Thoughts

Microsoft’s latest patch update is a critical step in enhancing the security of its software ecosystem. The proactive identification and resolution of these vulnerabilities, especially the zero-day ones, demonstrate the company’s commitment to cybersecurity. Users must prioritize applying these updates to ensure their systems remain protected against potential exploits.

Also Read:

• Enhancing Node.js Application Security: Essential Best Practices
• Maximizing Node.js Efficiency with Clustering and Load Balancing
• Understanding Event Emitters in Node.js for Effective Event Handling
• Understanding Streams in Node.js for Efficient Data Handling
• Harnessing Environment Variables in Node.js for Secure Configurations