zerofox logo
Advisories

Microsoft Patch Tuesday 05/10/2023 Notes

|by Alpha Team

banner image

Microsoft Patch Tuesday 5/10/2023 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for May 2023 contained 40 vulnerabilities, with:

  • 6 vulnerabilities rated as Critical
  • 32 vulnerabilities rated as Important
  • 3 zero-day vulnerabilities, of which two are actively exploited

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

Most notable vulnerabilities

This month’s Patch Tuesday cumulative Windows update includes the fixes for three zero-day vulnerabilities: CVE-2023-24932 (Secure Boot Security Feature Bypass Vulnerability), CVE-2023-29336 (Win32k Elevation of Privilege Vulnerability), and CVE-2023-29325 (Windows OLE Remote Code Execution Vulnerability). Two other significant bugs patched in this batch of updates include CVE-2023-24941 and CVE-2023-24949.

CVE-2023-24932

CVE-2023-24932 (CVSS score: 6.7) is a Secure Boot Security Feature Bypass Vulnerability. This zero-day bug is being actively exploited in attacks by the BlackLotus bootkit malware. In April 2023, Microsoft had published an advisory highlighting the threat posed by the BlackLotus campaign. Microsoft Windows could allow a remote authenticated attacker to bypass security restrictions because of this flaw in the Secure Boot component. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass authentication and obtain administrative access.

Affected products:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2023-29336

CVE-2023-29336 (CVSS score: 7.8) is a Win32k Elevation of Privilege Vulnerability that was known to be actively exploited and would lead to an attacker gaining SYSTEM level privileges on the target machine.

Affected products:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x6 4-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems

CVE-2023-29325

CVE-2023-29325 (CVSS score: 8.1) is a Windows OLE Remote Code Execution Vulnerability. The vulnerability is present in RTF documents and emails. An unauthenticated, remote attacker can exploit this vulnerability by sending a specially crafted document to a vulnerable system and then obtain remote control over the system.

Affected products:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

CVE-2023-24941

CVE-2023-24941 (CVSS score 9.8) is a Windows Network File System Remote Code Execution Vulnerability. Attackers can exploit this vulnerability by making an unauthenticated, specially crafted call to a Network File System service to trigger a Remote Code Execution. It requires no privileges or user interactions to exploit.

Affected products:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019

Users are advised to apply the latest security patches specified in Microsoft's May 2023 Patch Tuesday update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Tags: vulnerability/exploit,  technology,  all industries,  global