Microsoft Issues January 2023 Patch Tuesday Updates, Warns of Zero-Day Exploit

The first Patch Tuesday fixes shipped by Microsoft for 2023 have
addressed a total of 98 security flaws^[1], including one bug that
the company said is being actively exploited in the wild.

11 of the 98 issues are rated Critical and 87 are rated
Important in severity, with the vulnerabilities also listed as
publicly known at the time of release. Separately, the Windows
maker is expected to release updates for its Chromium-based Edge
browser.

The vulnerability that’s under attack relates to CVE-2023-21674^[2]
(CVSS score: 8.8), a privilege escalation flaw in Windows Advanced
Local Procedure Call (ALPC^[3]) that could be exploited
by an attacker to gain SYSTEM permissions.

“This vulnerability could lead to a browser sandbox escape,”
Microsoft noted in an advisory, crediting Avast researchers Jan
Vojtěšek, Milánek, and Przemek Gmerek for reporting the bug.

While details of the vulnerability are still under wraps, a
successful exploit requires an attacker to have already obtained an
initial infection on the host. It is also likely that the flaw is
combined with a bug present in the web browser to break out of the
sandbox and gain elevated privileges.

“Once the initial foothold has been made, attackers will look to
move across a network or gain additional higher levels of access
and these types of privilege escalation vulnerabilities are a key
part of that attacker playbook,” Kev Breen, director of cyber
threat research at Immersive Labs, said.

That having said, the chances that an exploit chain like this is
employed in a widespread fashion is limited owing to the
auto-update feature used to patch browsers, Satnam Narang, senior
staff research engineer at Tenable, said.

It’s also worth noting that the U.S. Cybersecurity and
Infrastructure Security Agency (CISA) has added^[4]
the vulnerability to its Known Exploited Vulnerabilities (KEV^[5]) catalog, urging federal
agencies to apply patches by January 31, 2023.

What’s more, CVE-2023-21674 is the fourth such flaw identified
in ALPC – an inter-process communication (IPC) facility provided by
the Microsoft Windows kernel – after CVE-2022-41045^[6], CVE-2022-41093^[7], and CVE-2022-41100^[8]
(CVSS scores: 7.8), the latter three of which were plugged in
November 2022^[9].

Two other privilege escalation vulnerabilities identified as
being of high priority affect Microsoft Exchange Server (CVE-2023-21763^[10] and CVE-2023-21764^[11], CVSS scores: 7.8),
which stem from an incomplete patch for CVE-2022-41123, according
to Qualys.

“An attacker could execute code with SYSTEM-level privileges by
exploiting a hard-coded file path,” Saeed Abbasi, manager of
vulnerability and threat research at Qualys, said in a
statement.

Also resolved by Microsoft is a security feature bypass in
SharePoint Server (CVE-2023-21743^[12], CVSS score: 5.3) that
could permit an unauthenticated attacker to circumvent
authentication and make an anonymous connection. The tech giant
noted, “customers must also trigger a SharePoint upgrade action
included in this update to protect their SharePoint farm.”

The January update further remediates a number of privilege
escalation flaws, including one in Windows Credential Manager
(CVE-2023-21726^[13], CVSS score: 7.8) and
three affecting the Print Spooler component (CVE-2023-21678^[14], CVE-2023-21760^[15], and CVE-2023-21765^[16]).

The U.S. National Security Agency (NSA) has been credited with
reporting CVE-2023-21678. In all, 39 of the vulnerabilities that
Microsoft closed out in its latest update enable the elevation of
privileges.

Rounding up the list is CVE-2023-21549^[17] (CVSS score: 8.8), a
publicly known elevation of privilege vulnerability in the Windows
SMB Witness Service, and another instance of security feature
bypass impacting BitLocker (CVE-2023-21563^[18], CVSS score: 6.8).

“A successful attacker could bypass the BitLocker Device
Encryption feature on the system storage device,” Microsoft said.
“An attacker with physical access to the target could exploit this
vulnerability to gain access to encrypted data.”

Furthermore, Redmond has updated its guidance^[19] regarding the malicious use^[20] of signed
drivers^[21] (called Bring Your Own
Vulnerable Driver) to include an updated block list^[22] released as part of
Windows security updates on January 10, 2023.

CISA on Tuesday also added CVE-2022-41080^[23], an Exchange Server
privilege escalation flaw, to the KEV catalog following reports
that the vulnerability is being chained^[24] alongside CVE-2022-41082^[25] to achieve remote code
execution on vulnerable systems.

The exploit, codenamed OWASSRF by CrowdStrike, has been
leveraged by the Play ransomware actors to breach target
environments. The defects were fixed^[26] by Microsoft in
November 2022.

The Patch Tuesday updates also arrive as Windows 7, Windows 8.1,
and Windows RT reached^[27] end of support^[28] on January 10, 2023.
Microsoft said it won’t be offering an Extended Security Update
(ESU) program for Windows 8.1, instead urging users to upgrade to
Windows 11.

“Continuing to use Windows 8.1 after January 10, 2023 may
increase an organization’s exposure to security risks or impact its
ability to meet compliance obligations,” the company cautions^[29].

Software Patches from Other Vendors

In addition to Microsoft, security updates have also been
released by other vendors since the start of the month to rectify
several vulnerabilities, including —