Microsoft Releases Patches for 130 Vulnerabilities, Including 6 Under Active Attack

Microsoft on Tuesday produced updates to address a whole of 130 new security flaws spanning its computer software, which includes six zero-day flaws that it reported have been actively exploited in the wild.

Of the 130 vulnerabilities, 9 are rated Critical and 121 are rated Critical in severity. This is in addition to 8 flaws the tech giant patched in its Chromium-based Edge browser toward the finish of very last month.

The checklist of issues that have occur beneath lively exploitation is as follows –

• CVE-2023-32046 (CVSS rating: 7.8) – Windows MSHTML Platform Elevation of Privilege Vulnerability
• CVE-2023-32049 (CVSS score: 8.8) – Windows SmartScreen Security Feature Bypass Vulnerability
• CVE-2023-35311 (CVSS rating: 8.8) – Microsoft Outlook Security Attribute Bypass Vulnerability
• CVE-2023-36874 (CVSS score: 7.8) – Windows Error Reporting Service Elevation of Privilege Vulnerability
• CVE-2023-36884 (CVSS score: 8.3) – Business and Windows HTML Remote Code Execution Vulnerability (Also publicly regarded at the time of the launch)
• ADV230001 – Malicious use of Microsoft-signed drivers for article-exploitation activity (no CVE assigned)

The Windows makers stated it truly is mindful of specific attacks versus protection and government entities in Europe and North The us that try to exploit CVE-2023-36884 by making use of specifically-crafted Microsoft Workplace document lures linked to the Ukrainian Environment Congress, echoing the most current conclusions from BlackBerry.

“An attacker could create a specially crafted Microsoft Business doc that enables them to conduct remote code execution in the context of the sufferer,” Microsoft said. “Nevertheless, an attacker would have to influence the sufferer to open the malicious file.”

The company has flagged the intrusion campaign to a Russian cybercriminal group it tracks as Storm-0978, which is also acknowledged by the names RomCom, Tropical Scorpius, UNC2596, and Void Rabisu.

“The actor also deploys the Underground ransomware, which is intently relevant to the Industrial Spy ransomware 1st observed in the wild in May perhaps 2022,” the Microsoft Danger Intelligence team described. “The actor’s hottest campaign detected in June 2023 associated abuse of CVE-2023-36884 to produce a backdoor with similarities to RomCom.”

Modern phishing attacks staged by the actor have entailed the use of trojanized variations of respectable software package hosted on lookalike web-sites to deploy a remote access trojan termed RomCom RAT from several Ukrainian and pro-Ukraine targets in Japanese Europe and North The united states.

Though RomCom was very first clocked as a group tied to Cuba ransomware, it has due to the fact been joined to other ransomware strains these as Industrial Spy as properly a new variant termed Underground as of July 2023, which reveals sizeable source code overlaps with Business Spy.

Microsoft reported it intends to take “proper motion to enable protect our customers” in the kind of an out-of-band security update or through its month-to-month launch method. In the absence of a patch for CVE-2023-36884, the business is urging customers to use the “Block all Place of work apps from generating little one processes” attack surface area reduction (ASR) rule.

Redmond even further reported it revoked code-signing certificates utilized to signal and put in destructive kernel-manner motorists on compromised programs by exploiting a Windows policy loophole to change the signing date of drivers right before July 29, 2015, by producing use of open up-source resources like HookSignTool and FuckCertVerifyTimeValidity.

The findings counsel that the use of rogue kernel-manner drivers is attaining traction amid risk actors as they run at the best privilege level on Windows, thereby producing it possible to build persistence for extended intervals of time while simultaneously interfering with the operating of security program to evade detection.

Future WEBINAR🔐 PAM Security – Expert Methods to Protected Your Delicate Accounts

This skilled-led webinar will equip you with the understanding and tactics you need to rework your privileged access security approach.

Reserve Your Location

It is really not presently not very clear how the other flaws are remaining exploited and how broadly those people attacks are unfold. But in gentle of lively abuse, it can be recommended that users shift quickly to apply the updates to mitigate opportunity threats.

Application Patches from Other Vendors

In addition to Microsoft, security updates have also been produced by other distributors around the past number of weeks to rectify a number of vulnerabilities, including —

• Adobe
• AMD
• Android
• Apache Projects
• Apple (it has due to the fact been pulled)
• Aruba Networks
• Cisco
• Citrix
• CODESYS
• Dell
• Drupal
• F5
• Fortinet
• GitLab
• Google Chrome
• Hitachi Vitality
• HP
• IBM
• Juniper Networks
• Lenovo
• Linux distributions Debian, Oracle Linux, Red Hat, SUSE, and Ubuntu
• MediaTek
• Mitsubishi Electric powered
• Mozilla Firefox, Firefox ESR, and Thunderbird
• NETGEAR
• NVIDIA
• Progress MOVEit Transfer
• Qualcomm
• Samsung
• SAP
• Schneider Electrical
• Siemens
• Synology
• VMware
• Zoom, and
• Zyxel

Uncovered this short article exciting? Adhere to us on Twitter  and LinkedIn to read more exclusive written content we post.

Some elements of this write-up are sourced from:
thehackernews.com