Technology NewsMicrosoft Issues January 2023 Patch Tuesday Updates, Warns of...

Microsoft Issues January 2023 Patch Tuesday Updates, Warns of Zero-Day Exploit

-


Microsoft Issues January 2023 Patch Tuesday Updates, Warns of Zero-Day Exploit

The first Patch Tuesday fixes shipped by Microsoft for 2023 have addressed a total of 98 security flaws, including one bug that the company said is being actively exploited in the wild.

11 of the 98 issues are rated Critical and 87 are rated Important in severity, with the vulnerabilities also listed as publicly known at the time of release. Separately, the Windows maker is expected to release updates for its Chromium-based Edge browser.

The vulnerability that’s under attack relates to CVE-2023-21674 (CVSS score: 8.8), a privilege escalation flaw in Windows Advanced Local Procedure Call (ALPC) that could be exploited by an attacker to gain SYSTEM permissions.

“This vulnerability could lead to a browser sandbox escape,” Microsoft noted in an advisory, crediting Avast researchers Jan Vojtěšek, Milánek, and Przemek Gmerek for reporting the bug.

While details of the vulnerability are still under wraps, a successful exploit requires an attacker to have already obtained an initial infection on the host. It is also likely that the flaw is combined with a bug present in the web browser to break out of the sandbox and gain elevated privileges.

“Once the initial foothold has been made, attackers will look to move across a network or gain additional higher levels of access and these types of privilege escalation vulnerabilities are a key part of that attacker playbook,” Kev Breen, director of cyber threat research at Immersive Labs, said.

That having said, the chances that an exploit chain like this is employed in a widespread fashion is limited owing to the auto-update feature used to patch browsers, Satnam Narang, senior staff research engineer at Tenable, said.

It’s also worth noting that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to apply patches by January 31, 2023.

What’s more, CVE-2023-21674 is the fourth such flaw identified in ALPC – an inter-process communication (IPC) facility provided by the Microsoft Windows kernel – after CVE-2022-41045, CVE-2022-41093, and CVE-2022-41100 (CVSS scores: 7.8), the latter three of which were plugged in November 2022.

Two other privilege escalation vulnerabilities identified as being of high priority affect Microsoft Exchange Server (CVE-2023-21763 and CVE-2023-21764, CVSS scores: 7.8), which stem from an incomplete patch for CVE-2022-41123, according to Qualys.

“An attacker could execute code with SYSTEM-level privileges by exploiting a hard-coded file path,” Saeed Abbasi, manager of vulnerability and threat research at Qualys, said in a statement.

Also resolved by Microsoft is a security feature bypass in SharePoint Server (CVE-2023-21743, CVSS score: 5.3) that could permit an unauthenticated attacker to circumvent authentication and make an anonymous connection. The tech giant noted, “customers must also trigger a SharePoint upgrade action included in this update to protect their SharePoint farm.”

The January update further remediates a number of privilege escalation flaws, including one in Windows Credential Manager (CVE-2023-21726, CVSS score: 7.8) and three affecting the Print Spooler component (CVE-2023-21678, CVE-2023-21760, and CVE-2023-21765).

The U.S. National Security Agency (NSA) has been credited with reporting CVE-2023-21678. In all, 39 of the vulnerabilities that Microsoft closed out in its latest update enable the elevation of privileges.

Rounding up the list is CVE-2023-21549 (CVSS score: 8.8), a publicly known elevation of privilege vulnerability in the Windows SMB Witness Service, and another instance of security feature bypass impacting BitLocker (CVE-2023-21563, CVSS score: 6.8).

“A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device,” Microsoft said. “An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data.”

Furthermore, Redmond has updated its guidance regarding the malicious use of signed drivers (called Bring Your Own Vulnerable Driver) to include an updated block list released as part of Windows security updates on January 10, 2023.

CISA on Tuesday also added CVE-2022-41080, an Exchange Server privilege escalation flaw, to the KEV catalog following reports that the vulnerability is being chained alongside CVE-2022-41082 to achieve remote code execution on vulnerable systems.

The exploit, codenamed OWASSRF by CrowdStrike, has been leveraged by the Play ransomware actors to breach target environments. The defects were fixed by Microsoft in November 2022.

The Patch Tuesday updates also arrive as Windows 7, Windows 8.1, and Windows RT reached end of support on January 10, 2023. Microsoft said it won’t be offering an Extended Security Update (ESU) program for Windows 8.1, instead urging users to upgrade to Windows 11.

“Continuing to use Windows 8.1 after January 10, 2023 may increase an organization’s exposure to security risks or impact its ability to meet compliance obligations,” the company cautions.

Software Patches from Other Vendors

In addition to Microsoft, security updates have also been released by other vendors since the start of the month to rectify several vulnerabilities, including —

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.



LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest news

all about the upcoming Redmi Band 2

The new generation of the Redmi smart bracelet will be presented very soon, and we already know its...

கடந்த காலத்தை குறியீடாக்குதல் – மர்மமான மாபெரும் அழிந்துபோன கடல் ஊர்வன கல்லறையின் தோற்றத்தை விஞ்ஞானிகள் கண்டுபிடித்துள்ளனர்

இக்தியோசர் இனத்தின் வயது வந்தோர் மற்றும் இளம் பருவத்தினர் ஷோனிசரஸ் பிரபலமானது 230 மில்லியன் ஆண்டுகளுக்கு முன்பு அம்மோனாய்டு இரையைத் துரத்தியது, இப்போது பெர்லின்-இக்தியோசர்...

Canonical has announced the availability of Ubuntu Pro subscriptions. What does this mean for regular users of this distro?

Canonical announced this morning that their Ubuntu Pro subscription service has been promoted from beta to general availability...

Hive Ransomware Infrastructure Seized in Joint International Law Enforcement Effort

Jan 26, 2023Ravie LakshmananEncryption / Ransomware The infrastructure associated with the Hive ransomware-as-a-service (RaaS) operation has been seized as...

Elite IT bachelor’s degree program starts at a domestic university

From artificial intelligence to digital molecular medical biology, students can acquire up-to-date knowledge and an internationally valuable diploma. ...

ZTE Blade V40 shows its face, specs revealed

ZTE has yet another V40 device up its sleeve and it's the Blade V40, that surfaced in Bangladesh....

Must read

டிகார்பனைசேஷனின் மறைக்கப்பட்ட செலவு: மக்கள்தொகை சீர்குலைவு

செக் குடியரசில் பிலினா நிலக்கரி சுரங்கம். கடன்: Marketa...

‘PATHAAN’ Movie Ticket Booking Offers

Pathaan Movie Ticket Booking Offers Pathaan movie ticket booking...