Microsoft Patch Tuesday 03/15/2023 Notes

Microsoft Patch Tuesday 3/15/2023 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for March 2023 contained 100 vulnerabilities, with:

• 5 vulnerabilities rated as Critical
• 54 vulnerabilities rated as High
• 2 actively exploited zero-day vulnerabilities

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

Most notable vulnerabilities

This month’s Patch Tuesday cumulative Windows update includes fixes for two actively exploited zero-day vulnerabilities: CVE-2023-23397 (a Microsoft Outlook Elevation of Privilege Vulnerability) and CVE-2023-24880 (a Windows SmartScreen Security Feature Bypass Vulnerability). Microsoft confirmed three of the Critical RCE vulnerabilities (CVE-2023-23392, CVE-2023-23415, and CVE-2023-23416) were all likely to be exploited and that it is working on patching CVE-2023-1017.

CVE-2023-23397

CVE-2023-23397 (CVSS score: 9.8) is a Microsoft Outlook Elevation of Privilege Vulnerability. The vulnerability can be abused by an attacker using crafted emails to direct the victim to an external attacker's control UNC location, resulting in a low-complexity attack. Upon retrieval and processing of the email by the Outlook client, the mail will be automatically triggered, potentially leading to exploitation even before the email is viewed in the Preview Pane.

The following products are affected:

• Microsoft Outlook 2016 (64-bit edition)
• Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
• Microsoft Outlook 2013 RT Service Pack 1
• Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
• Microsoft Office 2019 for 32-bit editions
• Microsoft 365 Apps for Enterprise for 32-bit Systems
• Microsoft Office 2019 for 64-bit editions
• Microsoft 365 Apps for Enterprise for 64-bit Systems
• Microsoft Office LTSC 2021 for 64-bit editions
• Microsoft Outlook 2016 (32-bit edition)
• Microsoft Office LTSC 2021 for 32-bit editions

CVE-2023-24880

CVE-2023-24880 (CVSS score: 5.4) is a Windows SmartScreen Security Feature Bypass Vulnerability that is being actively exploited in the wild. Attackers can exploit this to generate files that can circumvent Mark of the Web (MOTW) protections, rendering Microsoft Office features like SmartScreen and Protected View ineffective.

The following products are affected:

• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems

CVE-2023-23392

CVE-2023-23392 (CVSS score: 9.8) is a HTTP Protocol Stack Remote Code Execution Vulnerability. This RCE of Critical-class can be remotely exploited and does not require user interaction or system privileges. An attacker could successfully exploit this by sending a malicious packet to a targeted server that employs the vulnerable protocol for packet processing.

The following products are affected:

• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022

CVE-2023-23404

CVE-2023-23404 (CVSS score: 8.1) is a Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. This vulnerability requires an attacker to win a race condition in order to exploit it. An unauthenticated attacker could send a specially crafted connection request to a Remote Access (RAS) server, leading to remote code execution. While Microsoft has deemed the vulnerability "less likely to be exploitable" due to the need for the attacker to win a race condition, it still poses a significant threat.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2023-23411

CVE-2023-23411 (CVSS score: 6.5) is a Windows Hyper-V Denial of Service Vulnerability. An attacker can locally exploit this vulnerability in a low-complexity attack to affect the functionality of Hyper-V hosts

The following products are affected:

• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for x64-based Systems

CVE-2023-23415

CVE-2023-23415 (CVSS score: 9.8) is a Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability that requires no authentication, no user interaction, and can be attacked remotely. This can potentially allow an attacker to circumvent security mechanisms to get system or network access, exploitation can be performed by sending a malicious IP packet to a vulnerable target, leading to arbitrary code execution.

The following products are affected:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2023-1017

CVE-2023-1017 (CVSS score: 7.8) is an out-of-bounds write vulnerability in TPM2.0's Module Library which allows the writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. Microsoft is currently patching this issue.

The following products are affected:

• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for x64-based Systems

Users are advised to apply the latest security patches specified in Microsoft's March 2023 Patch Tuesday update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.