Microsoft Rolls Out Patches for 80 New Security Flaws — Two Under Active Attack

Mar 15, 2023Ravie LakshmananPatch Tuesday / Software Update

Microsoft’s Patch Tuesday update for March 2023 is rolling out
with remediations for a set of 80 security flaws^[1], two of which have come
under active exploitation in the wild.

Eight of the 80 bugs are rated Critical, 71 are rated Important,
and one is rated Moderate in severity. The updates are in addition to 29 flaws^[2]
the tech giant fixed in its Chromium-based Edge browser in recent
weeks.

The two vulnerabilities that have come under active attack
include a Microsoft Outlook privilege escalation flaw (CVE-2023-23397^[3], CVSS score: 9.8) and a
Windows SmartScreen security feature bypass (CVE-2023-24880^[4], CVSS score: 5.1).

CVE-2023-23397 is “triggered when an attacker sends a message
with an extended MAPI property with a UNC path to an SMB (TCP 445)
share on a threat actor-controlled server,” Microsoft said^[5]
in a standalone advisory.

A threat actor could leverage this flaw by sending a specially
crafted email, activating it automatically when it is retrieved and
processed by the Outlook client for Windows. As a result, this
could lead to exploitation without requiring any user interaction
and before even the message is viewed in the Preview Pane.

Microsoft credited the Computer Emergency Response Team of
Ukraine (CERT-UA) with reporting the flaw, adding it is aware of
“limited targeted attacks” mounted by a Russia-based threat actor
against government, transportation, energy, and military sectors in
Europe.

CVE-2023-24880, on the other hand, concerns a security bypass
flaw that could be exploited to evade Mark-of-the-Web (MotW)
protections when opening untrusted files downloaded from the
internet.

It is also the consequence of a narrow patch released by
Microsoft to resolve another SmartScreen bypass bug (CVE-2022-44698^[6], CVSS score: 5.4) that
came to light last year and which was exploited^[7]
by financially motivated actors to deliver Magniber ransomware.

“Vendors often release narrow patches, creating an opportunity
for attackers to iterate and discover new variants,” Google Threat
Analysis Group (TAG) researcher Benoit Sevens said^[8]
in a report.

“Because the root cause behind the SmartScreen security bypass
was not addressed, the attackers were able to quickly identify a
different variant of the original bug.”

TAG said it observed over 100,000 downloads of malicious MSI
files signed with malformed Authenticode signature since January
2023, thereby permitting the adversary to distribute Magniber
ransomware without raising any security warnings. A majority of
those downloads have been associated with users in Europe.

The disclosure also comes as the U.S. Cybersecurity and
Infrastructure Security Agency (CISA) added^[9]
the two flaws to the Known Exploited Vulnerabilities (KEV^[10]) catalog and announced^[11] a new pilot program^[12] that aims to warn
critical infrastructure entities about “vulnerabilities commonly
associated with known ransomware exploitation.”

Also closed out by Microsoft are a number of critical remote
code execution flaws impacting HTTP Protocol Stack (CVE-2023-23392^[13], CVSS score: 9.8),
Internet Control Message Protocol (CVE-2023-23415^[14], CVSS score: 9.8), and
Remote Procedure Call Runtime (CVE-2023-21708^[15], CVSS score: 9.8).

Other notable mentions include patches for four privilege
escalation bugs identified in the Windows Kernel, 10 remote code
execution flaws affecting Microsoft PostScript and PCL6 Class
Printer Driver, and a WebView2^[16] spoofing vulnerability
in the Edge browser.

Elsewhere, Microsoft also closed out two information disclosure
flaws in Microsoft OneDrive for Android, one spoofing vulnerability
in Office for Android, one security bypass bug in Microsoft
OneDrive for iOS, and one privilege escalation issue in OneDrive
for macOS.

Rounding off the list are patches for two high-severity
vulnerabilities^[18] in the Trusted Platform
Module (TPM^[19]) 2.0 reference library
specification (CVE-2023-1017^[20] and CVE-2023-1018^[21], CVSS scores: 8.8) that
could lead to information disclosure or privilege escalation.

Software Patches from Other Vendors

Aside from Microsoft, security updates have also been released
by other vendors since the start of the month to rectify several
vulnerabilities, including —