Microsoft Patch Tuesday, August 2023 Edition – Krebs on Security

Microsoft Corp. immediately issued software program updates to plug greater than 70 safety holes in its Home windows working programs and associated merchandise, together with a number of zero-day vulnerabilities at the moment being exploited within the wild.

Six of the failings mounted immediately earned Microsoft’s “crucial” score, that means malware or miscreants might use them to put in software program on a weak Home windows system with none assist from customers.

Final month, Microsoft acknowledged a sequence of zero-day vulnerabilities in quite a lot of Microsoft merchandise that have been found and exploited in-the-wild assaults. They have been assigned a single placeholder designation of CVE-2023-36884.

Satnam Narang, senior employees analysis engineer at Tenable, stated the August patch batch addresses CVE-2023-36884, which includes bypassing the Home windows Search Safety characteristic.

“Microsoft additionally launched ADV230003, a defense-in-depth replace designed to cease the assault chain related that results in the exploitation of this CVE,” Narang stated. “On condition that this has already been efficiently exploited within the wild as a zero-day, organizations ought to prioritize patching this vulnerability and making use of the defense-in-depth replace as quickly as potential.”

Redmond patched one other flaw that’s already seeing energetic assaults — CVE-2023-38180 — a weak point in .NET and Visible Studio that results in a denial-of-service situation on weak servers.

“Though the attacker would have to be on the identical community because the goal system, this vulnerability doesn’t require the attacker to have acquired consumer privileges,” on the goal system, wrote Nikolas Cemerikic, cyber safety engineer at Immersive Labs.

Narang stated the software program big additionally patched six vulnerabilities in Microsoft Change Server, together with CVE-2023-21709, an elevation of privilege flaw that was assigned a CVSSv3 (risk) rating of 9.8 out of a potential 10, although Microsoft charges it as an essential flaw, not crucial.

“An unauthenticated attacker might exploit this vulnerability by conducting a brute-force assault towards legitimate consumer accounts,” Narang stated. “Regardless of the excessive score, the assumption is that brute-force assaults received’t achieve success towards accounts with sturdy passwords. Nevertheless, if weak passwords are in use, this might make brute-force makes an attempt extra profitable. The remaining 5 vulnerabilities vary from a spoofing flaw and a number of distant code execution bugs, although essentially the most extreme of the bunch additionally require credentials for a sound account.”

Specialists at safety agency Automox known as consideration to CVE-2023-36910, a distant code execution bug within the Microsoft Message Queuing service that may be exploited remotely and with out privileges to execute code on weak Home windows 10, 11 and Server 2008-2022 programs. Microsoft says it considers this vulnerability “much less doubtless” to be exploited, and Automox says whereas the message queuing service just isn’t enabled by default in Home windows and is much less frequent immediately, any system with it enabled is at crucial threat.

Individually, Adobe has issued a crucial safety replace for Acrobat and Reader that resolves not less than 30 safety vulnerabilities in these merchandise. Adobe stated it’s not conscious of any exploits within the wild focusing on these flaws. The corporate additionally issued safety updates for Adobe Commerce and Adobe Dimension.

In case you expertise glitches or issues putting in any of those patches this month, please contemplate leaving a remark about it beneath; there’s a good probability different readers have skilled the identical and should chime in right here with helpful suggestions.

Further studying:

-SANS Web Storm Middle itemizing of every Microsoft vulnerability patched immediately, listed by severity and affected element.

–AskWoody.com, which retains tabs on any creating issues associated to the supply or set up of those updates.