Microsoft Issues January 2023 Patch Tuesday Updates, Warns of Zero-Day Exploit

The to start with Patch Tuesday fixes shipped by Microsoft for 2023 have tackled a full of 98 security flaws, including one particular bug that the firm reported is staying actively exploited in the wild.

11 of the 98 issues are rated Critical and 87 are rated Important in severity, with the vulnerabilities also outlined as publicly regarded at the time of launch. Individually, the Windows maker is anticipated to launch updates for its Chromium-centered Edge browser.

The vulnerability that’s underneath attack relates to CVE-2023-21674 (CVSS rating: 8.8), a privilege escalation flaw in Windows Innovative Local Treatment Phone (ALPC) that could be exploited by an attacker to obtain Procedure permissions.

“This vulnerability could lead to a browser sandbox escape,” Microsoft famous in an advisory, crediting Avast scientists Jan Vojtěšek, Milánek, and Przemek Gmerek for reporting the bug.

When aspects of the vulnerability are still under wraps, a effective exploit involves an attacker to have currently acquired an initial infection on the host. It is also probably that the flaw is merged with a bug current in the web browser to break out of the sandbox and get elevated privileges.

“At the time the original foothold has been built, attackers will appear to shift throughout a network or acquire extra higher concentrations of accessibility and these varieties of privilege escalation vulnerabilities are a important element of that attacker playbook,” Kev Breen, director of cyber danger investigate at Immersive Labs, explained.

That obtaining mentioned, the prospects that an exploit chain like this is used in a widespread style is constrained owing to the auto-update attribute employed to patch browsers, Satnam Narang, senior personnel research engineer at Tenable, explained.

It’s also well worth noting that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has additional the vulnerability to its Recognized Exploited Vulnerabilities (KEV) catalog, urging federal companies to utilize patches by January 31, 2023.

What’s far more, CVE-2023-21674 is the fourth these flaw identified in ALPC – an inter-procedure conversation (IPC) facility furnished by the Microsoft Windows kernel – immediately after CVE-2022-41045, CVE-2022-41093, and CVE-2022-41100 (CVSS scores: 7.8), the latter 3 of which ended up plugged in November 2022.

Two other privilege escalation vulnerabilities identified as staying of higher priority have an affect on Microsoft Exchange Server (CVE-2023-21763 and CVE-2023-21764, CVSS scores: 7.8), which stem from an incomplete patch for CVE-2022-41123, in accordance to Qualys.

“An attacker could execute code with System-amount privileges by exploiting a tough-coded file path,” Saeed Abbasi, supervisor of vulnerability and danger study at Qualys, claimed in a statement.

Also settled by Microsoft is a security attribute bypass in SharePoint Server (CVE-2023-21743, CVSS rating: 5.3) that could allow an unauthenticated attacker to circumvent authentication and make an nameless link. The tech huge observed, “buyers should also induce a SharePoint update motion provided in this update to defend their SharePoint farm.”

The January update further remediates a variety of privilege escalation flaws, which includes a person in Windows Credential Supervisor (CVE-2023-21726, CVSS score: 7.8) and three influencing the Print Spooler element (CVE-2023-21678, CVE-2023-21760, and CVE-2023-21765).

The U.S. Countrywide Security Agency (NSA) has been credited with reporting CVE-2023-21678. In all, 39 of the vulnerabilities that Microsoft shut out in its most recent update enable the elevation of privileges.

Rounding up the list is CVE-2023-21549 (CVSS rating: 8.8), a publicly identified elevation of privilege vulnerability in the Windows SMB Witness Provider, and a further occasion of security feature bypass impacting BitLocker (CVE-2023-21563, CVSS rating: 6.8).

“A successful attacker could bypass the BitLocker Unit Encryption attribute on the program storage device,” Microsoft explained. “An attacker with physical access to the target could exploit this vulnerability to acquire entry to encrypted info.”

Also, Redmond has updated its advice pertaining to the destructive use of signed motorists (called Bring Your Very own Susceptible Driver) to consist of an updated block listing launched as element of Windows security updates on January 10, 2023.

CISA on Tuesday also added CVE-2022-41080, an Exchange Server privilege escalation flaw, to the KEV catalog adhering to reports that the vulnerability is becoming chained together with CVE-2022-41082 to accomplish remote code execution on vulnerable devices.

The exploit, codenamed OWASSRF by CrowdStrike, has been leveraged by the Enjoy ransomware actors to breach focus on environments. The defects have been preset by Microsoft in November 2022.

The Patch Tuesday updates also get there as Windows 7, Windows 8.1, and Windows RT achieved end of help on January 10, 2023. Microsoft said it will never be offering an Extended Security Update (ESU) software for Windows 8.1, rather urging users to enhance to Windows 11.

“Continuing to use Windows 8.1 after January 10, 2023 may raise an organization’s publicity to security risks or impact its capability to satisfy compliance obligations,” the corporation cautions.

Software package Patches from Other Suppliers

In addition to Microsoft, security updates have also been released by other suppliers considering that the start of the month to rectify many vulnerabilities, which includes —

• Adobe
• AMD
• Android
• Cisco
• Citrix
• Dell
• F5
• Fortinet
• GitLab
• Google Chrome
• HP
• IBM
• Intel
• Juniper Networks
• Lenovo
• Linux distributions Debian, Oracle Linux, Pink Hat, SUSE, and Ubuntu
• MediaTek
• Qualcomm
• SAP
• Schneider Electrical
• Siemens
• Synology
• Zoom, and
• Zyxel

Observed this write-up intriguing? Stick to us on Twitter  and LinkedIn to read far more unique content material we publish.

Some areas of this short article are sourced from:
thehackernews.com