Microsoft Patch Tuesday 2/15/2023 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for February 2023 contained 77 vulnerabilities, with:

9 vulnerabilities rated as Critical
55 vulnerabilities rated as High
3 actively exploited zero-day vulnerabilities

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

Most notable vulnerabilities

This month’s Patch Tuesday cumulative Windows update includes fixes for three zero-day Privilege Escalation vulnerabilities: CVE-2023-21823, CVE-2023-21715, and CVE-2023-23376, which are being actively exploited in the wild.

The other significant bugs patched in this batch of updates include Windows Network File System Remote Code Execution (RCE) vulnerability: CVE-2023-21689, CVE-2023-21690, and CVE-2023-21692; Visual Studio Remote Code Execution vulnerabilities: CVE-2023-23381 and CVE-2023-21815. Microsoft also fixed Office vulnerabilities: CVE-2023-21716, which is a Microsoft Word bug that can lead to remote code execution and CVE-2023-21803, a vulnerability targeting how the Microsoft iSCSI Discovery Service handles certain requests.

CVE-2023-21823

CVE-2023-21823 (CVSS score: 7.8) is a Privilege Escalation Vulnerability which Microsoft indicated could potentially allow attackers to execute commands with SYSTEM privileges. This security update will be pushed out to users via the Microsoft Store rather than Windows Update. For those customers who disable automatic updates in the Microsoft Store, Microsoft will not be pushing out the update automatically.

The following products are affected:

Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 11 version 21H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Microsoft Office for iOS
Microsoft Office for Universal
Microsoft Office for Android

CVE-2023-21715 CVE-2023-21715 (CVSS score: 7.3) is a Security Bypass Vulnerability that can potentially allow an attacker to circumvent security mechanisms to get system or network access. impacts Microsoft Publisher. It has a local attack vector, requires some permissions, and requires user interaction. It involves the attacker using social engineering to get a user to go to a specially crafted website that leads to a local attack on that computer.

The following products are affected:

Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft 365 Apps for Enterprise for 64-bit Systems

CVE-2023-23376

CVE-2023-23376 (CVSS score: 7.8) is a Windows Common Log File System Driver Elevation of Privilege Vulnerability which allows an attacker who has successfully exploited the vulnerability to gain SYSTEM privileges.

The following products are affected:

Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 11 version 21H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

CVE-2023-21689

CVE-2023-21689 (CVSS score: 7.8) is a Security Bypass Vulnerability that can potentially allow an attacker to circumvent security mechanisms to get system or network access.

The following products are affected:

Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 11 version 21H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

CVE-2023-21529

CVE-2023-21529 (CVSS score: 8.8) is a Microsoft Exchange Server Remote Code Execution Vulnerability. It requires the attacker to be authenticated and if they receive authentication, the attacker could target the server accounts in an arbitrary or remote code execution. The following products are affected:

Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2019 Cumulative Update 12

CVE-2023-21716

CVE-2023-21716 (CVSS score: 9.8) is a Security Bypass Vulnerability Affecting Microsoft Office, primarily Microsoft Word. As a result of this bug, if a malicious file is loaded in the preview pane, an attacker could run code in the logged-on user’s context. This means the user would not even need to open the file to be infected. This has a network attack rating and requires no privileges or user interaction.

The following products are affected:

Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Word 2013 RT Service Pack 1
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft Word 2016 (32-bit edition)
Microsoft Word 2016 (64-bit edition)
Microsoft SharePoint Server 2019
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Office 2019 for Mac
Microsoft Office Online Server
SharePoint Server Subscription Edition Language Pack
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft SharePoint Server Subscription Edition
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft Office LTSC for Mac 2021

Users are advised to apply the latest security patches specified in Microsoft's February 2023 Patch Tuesday update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.