Microsoft Security Update: Addressing 58 Vulnerabilities and 5 Zero-Days
Dive into Microsoft's latest security patch update, covering 58 vulnerabilities and 5 zero-days, their risks, and mitigation strategies.
In November, Microsoft released patches to address a mix of vulnerabilities across its software suite. This included 5 zero-day vulnerabilities that were actively exploited, categorized as follows:
- Critical: 3 vulnerabilities
- Important: 56 vulnerabilities
- Moderate: 4 vulnerabilities
Zero-Day Vulnerabilities: A Closer Look
CVE-2023-36025: Windows SmartScreen Security Feature Bypass Vulnerability
- CVSSv3 Score: 8.8
- Impact: Allows bypassing Windows Defender SmartScreen checks.
- Context: Third zero-day related to Windows SmartScreen in 2023.
CVE-2023-36033: Windows DWM Core Library Elevation of Privilege Vulnerability
- CVSSv3 Score: 7.8
- Impact: Risk of attacker acquiring SYSTEM privileges.
CVE-2023-36036: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- CVSSv3 Score: 7.8
- Impact: Similar to CVE-2023-36033, elevating attacker privileges.
CVE-2023-36038: ASP.NET Core Denial of Service Vulnerability
- CVSSv3 Score: 8.2
- Impact: Exploitable via HTTP requests to .NET 8 RC 1 running on IIS InProcess hosting model.
CVE-2023-36413: Microsoft Office Security Feature Bypass Vulnerability
- CVSSv3 Score: 6.5
- Impact: Bypassing Office Protected View, requiring user action to open a malicious file.
Additional Considerations
- Threat Actors: No specific information on the attackers exploiting these vulnerabilities.
- CISA Advisory: Urgent patching advised, with a deadline set for December 5, 2023.
Addressing Critical Flaws
High-Risk Vulnerabilities
- CVE-2023-36052: Azure CLI REST Command Information Disclosure Vulnerability, with a CVSSv3 Score of 8.6.
- CVE-2023-36397: Windows PGM Remote Code Execution Vulnerability, with a CVSSv3 Score of 9.8.
- CVE-2023-36400: Windows HMAC Key Derivation Elevation of Privilege Vulnerability, with a CVSSv3 Score of 8.8.
Nature of the Flaws
- Azure CLI Vulnerability: Risk of extracting plaintext passwords and usernames from log files.
- Windows HMAC Key Derivation: Attacker gains SYSTEM privileges through a crafted application.
- Windows PGM Remote Code Execution: Exploitable via Windows message queuing service, leading to remote code execution.
Recommendations for Users
The primary recommendation for users and administrators is to install the latest security updates from Microsoft. These updates are crucial in mitigating the potential threats posed by these vulnerabilities. Regular system monitoring and adherence to security best practices are also recommended to further safeguard against potential exploits.
Conclusion and Final Thoughts
Microsoft's latest patch update is a critical step in enhancing the security of its software ecosystem. The proactive identification and resolution of these vulnerabilities, especially the zero-day ones, demonstrate the company's commitment to cybersecurity. Users must prioritize applying these updates to ensure their systems remain protected against potential exploits.
Vishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
