Microsoft Patch Tuesday, August 2023 Version – Krebs on Safety

Microsoft Corp. at the moment issued software program updates to plug greater than 70 safety holes in its Home windows working techniques and associated merchandise, together with a number of zero-day vulnerabilities presently being exploited within the wild.

Six of the issues mounted at the moment earned Microsoft’s “essential” ranking, that means malware or miscreants may use them to put in software program on a susceptible Home windows system with none assist from customers.

Final month, Microsoft acknowledged a sequence of zero-day vulnerabilities in quite a lot of Microsoft merchandise that have been found and exploited in-the-wild assaults. They have been assigned a single placeholder designation of CVE-2023-36884.

Satnam Narang, senior workers analysis engineer at Tenable, mentioned the August patch batch addresses CVE-2023-36884, which entails bypassing the Home windows Search Safety function.

“Microsoft additionally launched ADV230003, a defense-in-depth replace designed to cease the assault chain related that results in the exploitation of this CVE,” Narang mentioned. “Provided that this has already been efficiently exploited within the wild as a zero-day, organizations ought to prioritize patching this vulnerability and making use of the defense-in-depth replace as quickly as doable.”

Redmond patched one other flaw that’s already seeing energetic assaults — CVE-2023-38180 — a weak spot in .NET and Visible Studio that results in a denial-of-service situation on susceptible servers.

“Though the attacker would have to be on the identical community because the goal system, this vulnerability doesn’t require the attacker to have acquired person privileges,” on the goal system, wrote Nikolas Cemerikic, cyber safety engineer at Immersive Labs.

Narang mentioned the software program large additionally patched six vulnerabilities in Microsoft Trade Server, together with CVE-2023-21709, an elevation of privilege flaw that was assigned a CVSSv3 (risk) rating of 9.8 out of a doable 10, although Microsoft charges it as an necessary flaw, not essential.

“An unauthenticated attacker may exploit this vulnerability by conducting a brute-force assault in opposition to legitimate person accounts,” Narang mentioned. “Regardless of the excessive ranking, the idea is that brute-force assaults received’t achieve success in opposition to accounts with sturdy passwords. Nevertheless, if weak passwords are in use, this might make brute-force makes an attempt extra profitable. The remaining 5 vulnerabilities vary from a spoofing flaw and a number of distant code execution bugs, although probably the most extreme of the bunch additionally require credentials for a sound account.”

Consultants at safety agency Automox referred to as consideration to CVE-2023-36910, a distant code execution bug within the Microsoft Message Queuing service that may be exploited remotely and with out privileges to execute code on susceptible Home windows 10, 11 and Server 2008-2022 techniques. Microsoft says it considers this vulnerability “much less possible” to be exploited, and Automox says whereas the message queuing service shouldn’t be enabled by default in Home windows and is much less frequent at the moment, any machine with it enabled is at essential danger.

Individually, Adobe has issued a critical security update for Acrobat and Reader that resolves at the least 30 safety vulnerabilities in these merchandise. Adobe mentioned it isn’t conscious of any exploits within the wild focusing on these flaws. The corporate additionally issued safety updates for Adobe Commerce and Adobe Dimension.

If you happen to expertise glitches or issues putting in any of those patches this month, please take into account leaving a remark about it beneath; there’s a good likelihood different readers have skilled the identical and will chime in right here with helpful suggestions.

Further studying:

-SANS Web Storm Heart listing of every Microsoft vulnerability patched at the moment, listed by severity and affected part.

–AskWoody.com, which retains tabs on any growing issues associated to the supply or set up of those updates.