Microsoft Patches Three Zero-Day Bugs This Month

Microsoft launched patches for in excess of 70 CVEs this thirty day period, which includes 3 zero-day vulnerabilities presently being exploited in the wild.

The initially of these is CVE-2023-23376, an elevation of privilege flaw in the Frequent Log File System (CLFS) Driver. Tenable senior team research engineer, Satnam Narang, defined that Redmond patched two equivalent flaws in the CLFS Driver in April and September 2022.

The second zero-working day is CVE-2023-21823, a distant code execution (RCE) bug in the Microsoft Windows Graphics Ingredient that permits attackers to execute commands with system privileges.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“Being in a position to elevate privileges at the time on a target process is critical for attackers trying to get to do much more harm,” stated Narang.

“These flaws are beneficial in many contexts, whether or not an attacker launches an attack exploiting recognized vulnerabilities or by spear-phishing and malware payloads, which is why we often see elevation of privilege flaws routinely seem in Patch Tuesday releases as becoming exploited in the wild.”

The closing zero-working day, CVE-2023-21715, is a security aspect bypass in Microsoft Office.

“A neighborhood, authenticated attacker could exploit this vulnerability by employing social engineering tactics to encourage a opportunity target to execute a specially crafted file on their system, which would consequence in the bypass of Microsoft Office security characteristics that would usually block macros from being executed,” stated Narang.

In full, the selection of CVEs tackled in February’s Patch Tuesday yesterday is significantly less than January’s haul, but the existence of the zero-working day bugs will incorporate added urgency for sysadmins, as will the nine critical RCE flaws outlined.

“A much more diverse assortment than last month, February 2023 incorporates critical RCEs in an SQL Server ODBC driver, the iSCSI Discovery Provider, .NET/Visible Studio, 3 in network authentication framework PEAP, one particular in Word and two in Visible Studio only,” stated Speedy7 guide software package engineer, Adam Barnett.

“Microsoft has not observed in-the-wild exploitation for any of these vulnerabilities, nor are any of them marked as publicly disclosed. Microsoft predicts that most of these are much less likely to be exploited, with the exception of the PEAP vulnerabilities.”