zerofox logo
Advisories

Microsoft Patch Tuesday 08/09/2023 Notes

Alpha Team
banner image

Microsoft Patch Tuesday 8/09/2023 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for August 2023 contained 86 vulnerabilities, with:

  • 2 zero-day vulnerabilities
  • 6 vulnerabilities rated as Critical
  • 68 Vulnerabilities rated as High

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

Most notable vulnerabilities

This month’s patches include two actively exploited vulnerabilities, CVE-2023-38180 is notable as it does not require privileges and could be used for denial-of-service attacks on vulnerable servers. Microsoft released an in-depth update (ADV230003) for a patch-bypass of the actively-exploited CVE-2023-36884 zero-day which does not resolve it but helps stop its exploit chain from being used in attacks.

Two significant vulnerabilities within Microsoft Teams (CVE-2023-29328 and CVE-2023-29330) could enable remote attacks by luring the victim into participating in an adversary-created Teams meeting.

**CVE-2023-38180 **

CVE-2023-38180 (CVSS Score: 7.5) is an actively-exploited .NET and Visual Studio Denial of Service Vulnerability which could be exploited to launch denial-of-service (DoS) attacks on targeted systems. While details about the attack vector remain undisclosed in Microsoft's latest advisory, it is confirmed that the attacker's presence on the same network as the target system is required.

The following products are affected:

  • Microsoft Visual Studio 2022 version 17.6
  • Microsoft Visual Studio 2022 version 17.4
  • Microsoft Visual Studio 2022 version 17.2
  • .NET 7.0
  • .NET 6.0
  • ASP.NET Core 2.1

CVE-2023-29328

CVE-2023-29328 (CVSS Score: 8.8) along with CVE-2023-29330 (CVSS Score: 8.8) are two Microsoft Teams Remote Code Execution Vulnerabilities. These vulnerabilities have a local attack vector, and an attacker with direct access to the targeted device can launch remote attacks and do not require additional privileges. It requires perpetrators to deceive victims into attending compromised Teams meetings.

The following products are affected:

  • Microsoft Teams for Mac
  • Microsoft Teams for Android
  • Microsoft Teams for iOS
  • Microsoft Teams for Desktop

CVE-2023-36884

CVE-2023-36884 (CVSS Score: 8.3) is an Office and Windows HTML Remote Code Execution Vulnerability. Microsoft released a report highlighting the currently exploited bypass affecting the Windows Search Security Feature within affected products. While requiring no privileges, successful execution relies on user interaction with malicious links or attachments. The provided mitigation strategy emphasizes patching and implementation of the update (ADV230003) to counter the ongoing threat by disrupting the active exploitation chain. The August Patch Tuesday release updated the bug advisory page, reducing severity while adjusting CVSSv3 score.

The following product is affected:

  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2 (Server Core installation)

**CVE-2023-32057 **

CVE-2023-32057 (CVSS score: 9.8) is a Microsoft Message Queuing Remote Code Execution Vulnerability in the Microsoft Message Queuing (MSMQ) component of Windows operating systems. This vulnerability allows a remote unauthenticated attacker to execute arbitrary code by sending malicious MSMQ packets to a vulnerable MSMQ server. To successfully exploit this vulnerability, the Message Queuing service must be running on the affected server and listening on TCP port 1801.

The following products are affected:

  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2 (Server Core installation)

**CVE-2023-36912 **

CVE-2023-36912 (CVSS Score: 7.5) is a Microsoft Message Queuing Denial of Service Vulnerability. Successful exploitation of this flaw grants an unauthenticated attacker the capability to execute code remotely on the targeted server. Microsoft has assessed the probability of these vulnerabilities being exploited as low as it requires the Windows message queuing service to be running and the machine must remain responsive to TCP port 1801.

The following products are affected:

  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2019
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems

Users are advised to apply the latest security patches specified in Microsoft's August 2023 Patch Tuesday update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Tags:
technology
all industries
global
vulnerability/exploit