Microsoft Patch Tuesday 1/11/2023 Notes

Microsoft Patch Tuesday 1/11/2023 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for January 2023 involved 98 vulnerabilities in total, with:

• 11 vulnerabilities classified as Critical
• 1 zero-day vulnerability, which is being actively exploited

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

Most notable vulnerabilities

This month’s security updates include patches for a zero-day bug: CVE-2023-21674 – a Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege vulnerability, which is being actively exploited in the wild. Another significant bug patched in this batch is CVE-2023-21549 (a Windows SMB Witness Service Elevation of Privilege vulnerability).

A critical security bypass flaw, CVE-2023-21743, affects organizations running Microsoft SharePoint Server. To patch this vulnerability, it’s not enough to deploy the Microsoft updates. System administrators will also need to initiate a SharePoint upgrade action included in this update. Microsoft also issued patches for two Microsoft Exchange bugs: CVE-2023-21762 and CVE-2023-21745.

CVE-2023-21674

CVE-2023-21674 (CVSS score: 8.8) is a Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. This zero-day bug is being actively exploited in attacks.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2023-21549

CVE-2023-21549 (CVSS score: 8.8) is a Windows SMB Witness Service Elevation of Privilege Vulnerability. An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to privileged accounts only.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2023-21743

CVE-2023-21743 (CVSS score: 5.3) is a Microsoft SharePoint Server Security Feature Bypass Vulnerability. This bug can allow an attacker to circumvent security mechanisms to get system or network access. In a network-based attack, an unauthenticated attacker could bypass authentication and make an anonymous connection. To patch this vulnerability, in addition to applying the updates, customers must also trigger a SharePoint upgrade action included in this update to protect their SharePoint farm. The upgrade action can be triggered by running the SharePoint Products Configuration Wizard, the Upgrade-SPFarm PowerShell cmdlet, or the "psconfig.exe -cmd upgrade -inplace b2b" command on each SharePoint server after installing the update.

The following products are affected:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

CVE-2023-21762

CVE-2023-21762 (CVSS score: 8.0) is a Microsoft Exchange Server Spoofing Vulnerability. Exploiting this vulnerability could allow the disclosure of NTLM hashes. This vulnerability's attack is limited at the protocol level to a logically adjacent topology; it cannot simply be done across the internet, but instead needs something specific tied to the target. A successful attack could lead to a NTLM relay allowing for controls that would be able to block availability of a resource.

The following products are affected:

• Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Exchange Server 2016 Cumulative Update 23

CVE-2023-21745

CVE-2023-21745 (CVSS score: 8.0) is a Microsoft Exchange Server Spoofing Vulnerability. As a result of this bug, Microsoft Exchange Server could allow a remote authenticated attacker to conduct spoofing attacks. An authenticated attacker could achieve exploitation given a Powershell remoting session to the server. An authenticated attacker could exploit this vulnerability LAN-side or potentially from the internet.

The following products are affected:

• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Exchange Server 2016 Cumulative Update 23

Users are advised to apply the latest security patches specified in Microsoft's January 2023 Patch Tuesday update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.