Microsoft Patch Tuesday – March 2023

Microsoft patched 80 CVEs in its March 2023 Patch Tuesday Release, with 9 rated as critical, 79 rated as important and one rated as moderate.

Two actively exploited zero-day vulnerabilities we will highlight later in this blog  were reported by the vendor: an elevation of privilege within Microsoft Outlook (CVE-2023-23397) rated as Critical and a security feature bypass within Windows SmartScreen (CVE-2023-24880) rated as Moderate

This month’s update includes patches for:

• Azure
• Client Server Run-time Subsystem (CSRSS)
• Internet Control Message Protocol (ICMP)
• Microsoft Bluetooth Driver
• Microsoft Dynamics
• Microsoft Edge (Chromium-based)
• Microsoft Graphics Component
• Microsoft Office Excel
• Microsoft Office Outlook
• Microsoft Office SharePoint
• Microsoft OneDrive
• Microsoft PostScript Printer Driver
• Microsoft Printer Drivers
• Microsoft Windows Codecs Library
• Office for Android
• Remote Access Service Point-to-Point Tunnelling Protocol
• Role: DNS Server
• Role: Windows Hyper-V
• Service Fabric
• Visual Studio
• Windows Accounts Control
• Windows Bluetooth Service
• Windows Central Resource Manager
• Windows Cryptographic Services
• Windows Defender
• Windows HTTP Protocol Stack
• Windows HTTP.sys
• Windows Internet Key Exchange (IKE) Protocol
• Windows Kernel
• Windows Partition Management Driver
• Windows Point-to-Point Protocol over Ethernet (PPPoE)
• Windows Remote Procedure Call
• Windows Remote Procedure Call Runtime
• Windows Resilient File System (ReFS)
• Windows Secure Channel
• Windows SmartScreen
• Windows TPM
• Windows Win32K

Remote code execution (RCE) vulnerabilities accounted for 32.9% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 26.3%.

Microsoft Outlook Elevation of Privilege Vulnerability (Zero Day)

CVE-2023-23397 is an elevation of privilege vulnerability in Microsoft Outlook that was assigned a CVSSv3 score of 9.8 and was exploited in the wild. The vulnerability can be exploited by sending a malicious email to a vulnerable version of Outlook. When the email is processed by the server, a connection to an attacker-controlled device can be established to leak the Net-NTLMv2 hash of the email recipient. The attacker can use this hash to authenticate as the victim recipient in an NTLM relay attack.

Microsoft notes that this exploitation can occur before the email is viewed in the Preview Pane, meaning no interaction from the victim recipient is needed for a successful attack.

Windows SmartScreen Security Feature Bypass Vulnerability (Zero Day)

CVE-2023-24880 is a Windows SmartScreen Security Feature Bypass vulnerability in Windows operating systems that was assigned a CVSSv3 score of 5.4. The vulnerability has been publicly disclosed and was exploited in the wild. To be exploited, a malicious file needs to be opened by a user on an affected version of Windows. When the email is opened, the Mark of the Web (MoTW) functionality is bypassed, meaning that security features that rely on MoTW tagging are not triggered and could allow for malicious payloads within the file to be executed on the target.

Windows Cryptographic Services Remote Code Execution Vulnerability

CVE-2023-23416 is a RCE vulnerability in Windows operating systems that was assigned a CVSSv3 score of 8.4. The vulnerability exists in Windows Cryptographic Services, a suite of cryptographic tools in Windows operating systems. Exploitation is performed by importing a malicious certificate onto a vulnerable target, requiring the attacker to authenticate to the target or entice an authenticated user into importing the malicious certificate. As per the Microsoft Exploitability Index this was given a rating of Exploitation More Likely.

Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability

CVE-2023-23415 is a RCE vulnerability in Windows operating systems and was assigned a CVSSv3 score of 9.8. The vulnerability lies in the way the operating system handles ICMP packets when an application running on the vulnerable Windows host is bound to a raw socket. Exploitation is performed by sending a malicious fragmented IP packet to a vulnerable target, leading to arbitrary code execution. As per the Microsoft Exploitability Index this was given a rating of Exploitation More Likely.

HTTP Protocol Stack Remote Code Execution Vulnerability

CVE-2023-23392 is a RCE vulnerability in Microsoft operating systems that was given a CVSSv3 score of 9.8 and as per the Microsoft Exploitability Index this was given a rating of Exploitation More Likely. The vulnerability exists in the HTTP. sys component of Windows operating systems. Exploitation can be performed by a remote, unauthenticated attacker sending a malicious packet to the target server. For a server to be vulnerable, it must have HTTP/3 enabled and use buffered I/O. The Microsoft advisory notes that HTTP/3 support is a new feature for Windows Server 2022 and must be enabled with a registry key.

Trusted Platform Module (TPM) Module Library

CVE-2023-1017 and CVE-2023-1018, rated as Critical, are vulnerabilities affecting the TPM2.0 Module Library. An out-of-bounds write vulnerability allows the writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context

Windows Point-to-Point Tunnelling Protocol Remote Code Execution

CVE-2023-23404, a RCE vulnerability affecting the P2P Tunnelling Protocol, is rated as Critical. An unauthenticated attacker could send a specially crafted connection request to a remote access server (RAS), which could lead to remote code execution (RCE) on the RAS machine. As per the Microsoft Exploitability Index this was given a rating of Exploitation less Likely as it requires the attacker to win a race condition.

Windows Hyper-V Denial of Service

CVE-2023-23411, a Denial-of-Service vulnerability affecting Windows Hyper-V, is rated as Critical. Successful exploitation of this vulnerability could allow a Hyper-V guest to affect the functionality of the Hyper-V host. As per the Microsoft Exploitability Index this was given a rating of Exploitation less Likely.

This month patch Tuesday summary

Chromium Edge Updates