This month the Patching Tuesday brings us 59 new CVEs including 2 zero-days and 5 criticals. Look like a common month? Let’s check!
CVE-2023-36761 – Microsoft Word Information Disclosure Vulnerability
This critical bug in Word comes first. Microsoft classified that as an information disclosure vulnerability, but… this one allows the disclosure of NTLM hashes, presumably used in an NTLM-relay style attack. For me, sounds more critical than only information disclosure. Nonetheless, the preview pane is also an attack vector, which means no user interaction is required. Exploitation was detected, so consider patching ASAP.
CVE-2023-36802 – Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
There is not a lot of information about this one, which is the second zero-day. The only we know for sure is that an attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
CVE-2023-38148 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
First non-zero day, rated as Critical, with a score 8.8. It’s limited to network-adjacent attacks and successful exploitation also relies on enabled ICS service, which is not a default configuration. If you need enabled ICS service on your systems, then patching is required.
CVE-2023-29332 – Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
This Critical-rated bug in the Azure Kubernetes service could allow a remote, unauthenticated attacker to gain Cluster Administration privileges. It’s not the first bug in that service, but this one stands out as it can be reached from the Internet, requires no user interaction, and the complexity of the attack is low.
CVE-2023-36792 / CVE-2023-36793 / CVE-2023-36796 – Visual Studio Remote Code Execution Vulnerability
All of these three bugs could lead to arbitrary code execution when opening a malicious package file with an affected version of Visual Studio. This month there are also 5 other bugs in Visual Studio (with lower scores), so definitely consider patching.
Summary
It seems the most important bug this month is the first on the list. Please be aware that there are 4 new bugs in Exchange as well, but if you patched your Exchange last month, you are safe 🙂
Below you can see the most important CVEs released by Microsoft in September 2023
| CVE Number | CVE Title | Severity (CVSS score) | Attack Vector | Attack Complexity | Privileges Required | User interaction | Exploit Code Maturity | Applicable for |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-36761 | Microsoft Word Information Disclosure Vulnerability | Important (6.2) | Local | Low | None | None | Exploited | Word 2013, 2016, 2019 Office LTSC 2021 Microsoft 365 Apps |
| CVE-2023-36802 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | Important (7.8) | Local | Low | Low | None | Exploited | Windows 10+ Windows Server 2019+ |
| CVE-2023-38148 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability | Critical (8.8) | Adjacent | Low | None | None | Unproven | Windows 10+ Windows Server 2022+ |
| CVE-2023-29332 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability | Critical (7.5) | Network | Low | None | None | Unproven | Azure Kubernetes Service |
| CVE-2023-36792 | Visual Studio Remote Code Execution Vulnerability | Critical (7.8) | Network | Low | None | Required | Unproven | .NET 6.0, 7.0 Visual Studio 2022 17.2, 17.4, 17.7 Visual Studio 2019 16.11- Visual Studio 2017 15.9- .NET Framework 3.5 / 4.8 / 4.8.1 on Windows Server 2022 / Windows 11 .NET Framework 3.5 / 4.7.2 / 4.8 on Windows Server 2019 .NET Framework 4.8 on Windows Server 2016 .NET Framework 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 on Windows Server 2012 / 2012 R2 .NET Framework 3.5.1 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 on Windows Server 2008 R2 .NET Framework 2.0 SP2 / 3.0 SP2 / 4.6.2 on Windows Server 2008 .NET Framework 3.5 / 4.7.2 / 4.8 / 4.8.1 on Windows 10 |
| CVE-2023-36793 | Visual Studio Remote Code Execution Vulnerability | Critical (7.8) | Local | Low | None | Required | Unproven | .NET 6.0, 7.0 Visual Studio 2022 17.2, 17.4, 17.6, 17.7 Visual Studio 2019 16.11- Visual Studio 2017 15.9- .NET Framework 3.5 / 4.8 / 4.8.1 on Windows Server 2022 / Windows 11 .NET Framework 3.5 / 4.7.2 / 4.8 on Windows Server 2019 .NET Framework 4.8 on Windows Server 2016 .NET Framework 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 on Windows Server 2012 / 2012 R2 .NET Framework 3.5.1 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 on Windows Server 2008 R2 .NET Framework 2.0 SP2 / 3.0 SP2 / 4.6.2 on Windows Server 2008 .NET Framework 3.5 / 4.7.2 / 4.8 / 4.8.1 on Windows 10 |
| CVE-2023-36796 | Visual Studio Remote Code Execution Vulnerability | Critical (7.8) | Network | Low | None | Required | Unproven | .NET 6.0, 7.0 Visual Studio 2022 17.2, 17.4, 17.6, 17.7 Visual Studio 2019 16.11- Visual Studio 2017 15.9- .NET Framework 3.5 / 4.8 / 4.8.1 on Windows Server 2022 / Windows 11 .NET Framework 3.5 / 4.7.2 / 4.8 on Windows Server 2019 .NET Framework 4.8 on Windows Server 2016 .NET Framework 3.5 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 on Windows Server 2012 / 2012 R2 .NET Framework 3.5.1 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 on Windows Server 2008 R2 .NET Framework 2.0 SP2 / 3.0 SP2 / 4.6.2 on Windows Server 2008 .NET Framework 3.5 / 4.7.2 / 4.8 / 4.8.1 on Windows 10 |
| CVE-2023-33136 | Azure DevOps Server Remote Code Execution Vulnerability | Important (8.8) | Network | Low | Low | None | Unproven | Azure DevOps Server 2019.0.1 Azure DevOps Server 2019.1.2 Azure DevOps Server 2020.0.2 Azure DevOps Server 2020.1.2 Azure DevOps Server 2022.0.1 |
| CVE-2023-36744 | Microsoft Exchange Server Remote Code Execution Vulnerability | Important (8.0) | Adjacent | Low | Low | None | Unproven | Exchange 2016 CU23 Exchange 2019 CU12+ |
| CVE-2023-36745 | Microsoft Exchange Server Remote Code Execution Vulnerability | Important (8.0) | Adjacent | Low | Low | None | Unproven | Exchange 2016 CU23 Exchange 2019 CU12+ |
| CVE-2023-36756 | Microsoft Exchange Server Remote Code Execution Vulnerability | Important (8.0) | Adjacent | Low | Low | None | Unproven | Exchange 2016 CU23 Exchange 2019 CU12+ |
| CVE-2023-36757 | Microsoft Exchange Server Spoofing Vulnerability | Important (8.0) | Adjacent | Low | Low | None | Unproven | Exchange 2016 CU23 Exchange 2019 CU12+ |
| CVE-2023-36764 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Important (8.8) | Network | Low | Low | None | Unproven | SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, SharePoint Server Subscription Edition |
| CVE-2023-38147 | Windows Miracast Wireless Display Remote Code Execution Vulnerability | Important (8.8) | Adjacent | Low | None | None | Unproven | Windows 10+ Windows Server 2016+ |
| CVE-2023-38146 | Windows Themes Remote Code Execution Vulnerability | Important (8.8) | Network | Low | None | Required | Unproven | Windows 11+ |
- Microsoft Patch Tuesday – January 2024 - January 10, 2024
- Microsoft Patch Tuesday – November 2023 - November 15, 2023
- Microsoft Patch Tuesday – October 2023 - October 11, 2023