Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit

Apr 12, 2023Ravie LakshmananPatch Tuesday / Software Updates

It’s the second Tuesday of the month, and Microsoft has released
another set of security updates to fix a total of 97 flaws^[1]
impacting its software, one of which has been actively exploited in
ransomware attacks in the wild.

Seven of the 97 bugs are rated Critical and 90 are rated
Important in severity. Interestingly, 45 of the shortcomings are
remote code execution flaws, followed by 20 elevation of privilege
vulnerabilities. The updates also follow fixes for 26
vulnerabilities in its Edge browser that were released over the
past month.

The security flaw that’s come under active exploitation is
CVE-2023-28252^[2]
(CVSS score: 7.8), a privilege escalation bug in the Windows Common
Log File System (CLFS) Driver.

“An attacker who successfully exploited this vulnerability could
gain SYSTEM privileges,” Microsoft said in an advisory, crediting
researchers Boris Larin, Genwei Jiang, and Quan Jin for reporting
the issue.

CVE-2023-28252 is the fourth privilege escalation flaw in the
CLFS component that has come under active abuse in the past year
alone after CVE-2022-24521^[3], CVE-2022-37969^[4], and CVE-2023-23376^[5]
(CVSS scores: 7.8). At least 32 vulnerabilities have been
identified in CLFS since 2018.

According to Russian cybersecurity firm Kaspersky, the
vulnerability has been weaponized by a cybercrime group to deploy
Nokoyawa ransomware^[6]
against small and medium-sized businesses in the Middle East, North
America, and Asia.

“CVE-2023-28252 is an out-of-bounds write (increment)
vulnerability that can be exploited when the system attempts to
extend the metadata block,” Larin said^[7]. “The vulnerability gets
triggered by the manipulation of the base log file.”

In light of ongoing exploitation of the flaw, CISA added^[8]
the Windows zero-day to its catalog of Known Exploited
Vulnerabilities (KEV^[9]), ordering Federal
Civilian Executive Branch (FCEB) agencies to secure their systems
by May 2, 2023.

Also patched are critical remote code execution flaws impacting
DHCP Server Service, Layer 2 Tunneling Protocol, Raw Image
Extension, Windows Point-to-Point Tunneling Protocol, Windows
Pragmatic General Multicast, and Microsoft Message Queuing
(MSMQ^[10]).

The MSMQ bug, tracked as CVE-2023-21554^[11] (CVSS score: 9.8) and
dubbed QueueJumper by Check Point, could lead to unauthorized code
execution and take over a server by sending a specially crafted
malicious MSMQ packet to an MSMQ server.

“The CVE-2023-21554 vulnerability allows an attacker to
potentially execute code remotely and without authorization by
reaching the TCP port 1801,” Check Point researcher Haifei Li
said^[12]. “In other words, an
attacker could gain control of the process through just one packet
to the 1801/tcp port with the exploit, triggering the
vulnerability.”

Two other flaws discovered in MSMQ, CVE-2023-21769^[13] and CVE-2023-28302^[14] (CVSS scores: 7.5),
could be exploited to cause a denial-of-service (DoS) condition
such as a service crash and Windows Blue Screen of Death (BSoD^[15]).

Microsoft has also updated its advisory for CVE-2013-3900^[17], a WinVerifyTrust
signature validation vulnerability, to include the following Server
Core installation versions –

• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for x65-based Systems Service Pack 2
• Windows Server 2008 R2 for x64-based Systems Service 1
• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019, and
• Windows Server 2022

The development comes as North Korea-linked threat actors have
been observed leveraging the flaw^[18] to incorporate
encrypted shellcode into legitimate libraries without invalidating
the Microsoft-issued signature.

Software Patches from Other Vendors

In addition to Microsoft, security updates have also been
released by other vendors in the last few weeks to rectify several
vulnerabilities, including —