Microsoft Patch Tuesday – November 2023

Microsoft patched 58 CVEs in its November 2023 Patch Tuesday release, with three rated critical and 54 rated important. This doesn’t include Microsoft EDGE updates.

• 16 Elevation of Privilege Vulnerabilities
• 6 Security Feature Bypass Vulnerabilities
• 15 Remote Code Execution Vulnerabilities
• 6 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 11 Spoofing Vulnerabilities

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2023-36025 is a security feature bypass vulnerability in Windows SmartScreen. With a CVSSv3 score of 8.8 and is rated important. It was exploited in the wild as a zero-day. An attacker could exploit this flaw by crafting a malicious Internet Shortcut (.URL) file and convincing a target to click on the file or a hyperlink pointing to a.URL file. Successful exploitation would result in a bypass of the security checks in Windows Defender SmartScreen. This is the third Windows SmartScreen zero-day vulnerability exploited in the wild in 2023 and the fourth in the last two years. CVE-2022-44698, CVE-2023-24880, CVE-2023-32049

Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2023-36033 is an EoP vulnerability in the DWM Core Library in Microsoft Windows. With a CVSSv3 score of 7.8 and is rated as important. Microsoft noted that it was exploited in the wild as a zero-day and was publicly disclosed prior to a patch being available. A local attacker with a presence on a vulnerable system could exploit it to gain SYSTEM privileges.

This is the 12th EoP vulnerability patched in the DWM Core Library in the last two years, with 10 patched in 2022 and one patched earlier this year in the January 2023 Patch Tuesday release (CVE-2023-21724). However, this is the first DWM Core Library EoP vulnerability that was exploited in the wild as a zero-day in the last two years.

ASP.NET Core Denial of Service Vulnerability

CVE-2023-36038 is a denial-of-service vulnerability in the open-source web application framework, ASP.NET. With a CVSSv3 score of 8.2 and rated as important. Microsoft rates it as Exploitation Less Likely. An attacker that could successfully exploit this vulnerability could trigger an OutOfMemoryException, resulting in a DoS condition. Microsoft notes that this vulnerability was publicly disclosed, however no in-the-wild exploitation has been observed.

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CVE-2023-36036 is an EoP vulnerability in Microsoft Windows Cloud Files Mini Filter Driver (cldflt.sys). With a CVSSv3 score of 7.8 and is rated as important. Microsoft says it has been exploited in the wild and is credited to b​​oth the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC). No further details were revealed and like most EoP flaws, if a local attacker exploits this flaw, they would be able to elevate privileges to SYSTEM.

Microsoft Office Security Feature Bypass Vulnerability

CVE-2023-36413 is a security feature bypass vulnerability in Microsoft Office. With a CVSSv3 score of 6.5 and is rated as important. An attacker could exploit this vulnerability using social engineering tactics to convince a target to open a malicious Microsoft Office file on a vulnerable system. Successful exploitation would result in a bypass of security features of Microsoft Office designed to protect users including Protected View and the file would be opened in editing mode instead of protected mode. Microsoft says details about this flaw have been publicly disclosed prior to a patch being available.

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2023-36439 is an RCE vulnerability in Microsoft Exchange Server. With a CVSSv3 score of 8.0 and rated as important. An attacker authenticated to a vulnerable Exchange Server as a valid user could exploit this vulnerability to gain RCE as NT AUTHORITY\SYSTEM on the backend of the server mailbox. Microsoft rates this vulnerability as Exploitation More Likely. It is one of four vulnerabilities in Microsoft Exchange Server patched in this month’s Patch Tuesday release. With the significant historical exploitation of Microsoft Exchange Server by attackers, we continue to monitor for and highlight flaws in Exchange Server in each Patch Tuesday release.

Microsoft Exchange Server Spoofing Vulnerability

CVE-2023-36035, CVE-2023-36039 and CVE-2023-36050 are spoofing vulnerabilities in Microsoft Exchange Server. All three vulnerabilities were assigned a CVSSv3 score of 8.0 and are rated as important. An attacker could exploit these flaws by possessing valid credentials for an Exchange user on a vulnerable Exchange Server instance. Exploitation of CVE-2023-36035 and CVE-2023-36039 would allow an attacker to access the Net-NTLMv2 hash of the user account which could be utilized in NTLM Relay attacks against other services.

SOCKS5 Heap Buffer Overflow in curl

CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and curl. This flaw was disclosed and patched on October 11. Curl is one of the most widely used open-source projects and Microsoft includes curl.exe in Windows and Windows Server. On October 19, Microsoft published an initial advisory for this vulnerability though no fixes were available at the time. However, a fixed version of curl.exe, version 8.0.4, was included in the Windows updates as part of this month’s Patch Tuesday release.

Patch Tuesday Summary