2023-11-15 03:26:7 Author: www.tenable.com(查看原文) 阅读量:34 收藏
Microsoft addresses 57 CVEs, including three zero-day vulnerabilities that were exploited in the wild.
- 3Critical
- 54Important
- 0Moderate
- 0Low
Microsoft patched 57 CVEs in its November 2023 Patch Tuesday release, with three rated critical and 54 rated important. We omitted one vulnerability from our counts this month, CVE-2023-24023, a Bluetooth Vulnerability as this flaw was reported through MITRE.
This month’s update includes patches for:
- .NET Framework
- ASP.NET
- Azure
- Azure DevOps
- Microsoft Bluetooth Driver
- Microsoft Dynamics
- Microsoft Dynamics 365 Sales
- Microsoft Exchange Server
- Microsoft Office
- Microsoft Office Excel
- Microsoft Office SharePoint
- Microsoft Remote Registry Service
- Microsoft WDAC OLE DB provider for SQL
- Microsoft Windows Search Component
- Microsoft Windows Speech
- Open Management Infrastructure
- Tablet Windows User Interface
- Visual Studio
- Visual Studio Code
- Windows Authentication Methods
- Windows Cloud Files Mini Filter Driver
- Windows Common Log File System Driver
- Windows Compressed Folder
- Windows Defender
- Windows Deployment Services
- Windows DHCP Server
- Windows Distributed File System (DFS)
- Windows DWM Core Library
- Windows HMAC Key Derivation
- Windows Hyper-V
- Windows Installer
- Windows Internet Connection Sharing (ICS)
- Windows Kernel
- Windows NTFS
- Windows Protected EAP (PEAP)
- Windows Scripting
- Windows SmartScreen
- Windows Storage
Elevation of privilege (EoP) vulnerabilities accounted for 28.1% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 26.3%.
CVE-2023-36025 | Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2023-36025 is a security feature bypass vulnerability in Windows SmartScreen. It was assigned a CVSSv3 score of 8.8 and is rated important. According to Microsoft, it was exploited in the wild as a zero-day. An attacker could exploit this flaw by crafting a malicious Internet Shortcut (.URL) file and convincing a target to click on the file or a hyperlink pointing to a.URL file. Successful exploitation would result in a bypass of the security checks in Windows Defender SmartScreen.
This is the third Windows SmartScreen zero-day vulnerability exploited in the wild in 2023 and the fourth in the last two years:
CVE-2023-36033 | Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2023-36033 is an EoP vulnerability in the DWM Core Library in Microsoft Windows. It was assigned a CVSSv3 score of 7.8 and is rated as important. Microsoft noted that it was exploited in the wild as a zero-day and was publicly disclosed prior to a patch being available. A local attacker with a presence on a vulnerable system could exploit it to gain SYSTEM privileges. It was disclosed to Microsoft by security researcher Quan Jin of DBAPPSecurity WeBin Lab, who is credited with discovering two other EoP zero-day vulnerabilities in 2023:
| CVE | Description | CVSSv3 | Severity | Patch Tuesday |
|---|---|---|---|---|
| CVE-2023-28252 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | 7.8 | Important | April 2023 |
| CVE-2023-36802 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | 7.8 | Important | September 2023 |
This is the 12th EoP vulnerability patched in the DWM Core Library in the last two years, with 10 patched in 2022 and one patched earlier this year in the January 2023 Patch Tuesday release (CVE-2023-21724). However, this is the first DWM Core Library EoP vulnerability that was exploited in the wild as a zero-day in the last two years.
CVE-2023-36038 | ASP.NET Core Denial of Service Vulnerability
CVE-2023-36038 is a denial of service (DoS) vulnerability in the open-source web application framework, ASP.NET. It was assigned a CVSSv3 score of 8.2 and rated as important. Microsoft rates it as Exploitation Less Likely according to the Microsoft Exploitability Index. An attacker that could successfully exploit this vulnerability could trigger an OutOfMemoryException, resulting in a DoS condition. Microsoft notes that this vulnerability was publicly disclosed, however no in-the-wild exploitation has been observed.
CVE-2023-36036 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2023-36036 is an EoP vulnerability in Microsoft Windows Cloud Files Mini Filter Driver (cldflt.sys). It was assigned a CVSSv3 score of 7.8 and is rated as important. Microsoft says it has been exploited in the wild and is credited to both the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC). While Microsoft did not provide specific details around this vulnerability, like most EoP flaws, if a local attacker exploits this flaw, they would be able to elevate privileges to SYSTEM.
CVE-2023-36413 | Microsoft Office Security Feature Bypass Vulnerability
CVE-2023-36413 is a security feature bypass vulnerability in Microsoft Office. It was assigned a CVSSv3 score of 6.5 and is rated as important. An attacker could exploit this vulnerability using social engineering tactics to convince a target to open a malicious Microsoft Office file on a vulnerable system. Successful exploitation would result in a bypass of security features of Microsoft Office designed to protect users including Protected View and the file would be opened in editing mode instead of protected mode. Microsoft says details about this flaw have been publicly disclosed prior to a patch being available.
Disclosure of these flaws to Microsoft is credited to security researcher Eduardo Braun Prado and Will Dormann.
CVE-2023-36439 | Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36439 is an RCE vulnerability in Microsoft Exchange Server. It was assigned a CVSSv3 score of 8.0 and rated as important. An attacker authenticated to a vulnerable Exchange Server as a valid user could exploit this vulnerability to gain RCE as NT AUTHORITY\SYSTEM on the backend of the server mailbox. Microsoft rates this vulnerability as Exploitation More Likely. It is one of four vulnerabilities in Microsoft Exchange Server patched in this month’s Patch Tuesday release. With the significant historical exploitation of Microsoft Exchange Server by attackers, we continue to monitor for and highlight flaws in Exchange Server in each Patch Tuesday release.
CVE-2023-36035, CVE-2023-36039, CVE-2023-36050 | Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36035, CVE-2023-36039 and CVE-2023-36050 are spoofing vulnerabilities in Microsoft Exchange Server. All three vulnerabilities were assigned a CVSSv3 score of 8.0 and are rated as important. An attacker could exploit these flaws by possessing valid credentials for an Exchange user on a vulnerable Exchange Server instance. Exploitation of CVE-2023-36035 and CVE-2023-36039 would allow an attacker to access the Net-NTLMv2 hash of the user account which could be utilized in NTLM Relay attacks against other services.
Tenable Solutions
A list of all the plugins released for Tenable’s November 2023 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.
For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.
Get more information
- Microsoft's November 2023 Security Updates
- Tenable plugins for Microsoft November 2023 Patch Tuesday Security Updates
Join Tenable's Security Response Team on the Tenable Community
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Tenable Security Response Team
The Tenable Security Response Team (SRT) tracks threat and vulnerability intelligence feeds to ensure our research teams can deliver sensor coverage to our products as quickly as possible. The SRT also works to analyze and assess technical details and writes white papers, blogs and additional communications to ensure stakeholders are fully informed of the latest risks and threats. The SRT provides breakdowns for the latest vulnerabilities on the Tenable blog.
Related Articles
- Exposure Management
- Vulnerability Management
Cybersecurity News You Can Use
Enter your email and never miss timely alerts and security guidance from the experts at Tenable.
Tenable Vulnerability Management
Formerly Tenable.io
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.
Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.
Tenable Vulnerability Management
Formerly Tenable.io
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
100 assets
Choose Your Subscription Option:
Thank You
Thank you for your interest in Tenable.io. A representative will be in touch soon.
Try Tenable Nessus Professional Free
FREE FOR 7 DAYS
Tenable Nessus is the most comprehensive vulnerability scanner on the market today.
NEW - Tenable Nessus Expert
Now Available
Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.
Fill out the form below to continue with a Nessus Pro Trial.
Buy Tenable Nessus Professional
Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.
Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.
Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.
BUY
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
100 assets
Choose Your Subscription Option:
Thank You
Thank you for your interest in Tenable.io. A representative will be in touch soon.
Try Tenable Web App Scanning
Formerly Tenable.io Web Application Scanning
Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.
Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.
Buy Tenable Web App Scanning
Formerly Tenable.io Web Application Scanning
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
Try Tenable Lumin
Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.
Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.
Buy Tenable Lumin
Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.
Thank You
Thank you for your interest in Tenable Lumin. A representative will be in touch soon.
Request a demo of Tenable Security Center
Formerly Tenable.sc
Please fill out this form with your contact information.
A sales representative will contact you shortly to schedule a demo.
* Field is required
Request a demo of Tenable OT Security
Formerly Tenable.ot
Get the Operational Technology Security You Need.
Reduce the Risk You Don’t.
Request a demo of Tenable Identity Exposure
Formerly Tenable.ad
Continuously detect and respond to Active Directory attacks. No agents. No privileges.
On-prem and in the cloud.
Request a Demo of Tenable Cloud Security
Exceptional unified cloud security awaits you!
We’ll show you exactly how Tenable Cloud Security helps you deliver multi-cloud asset discovery, prioritized risk assessments and automated compliance/audit reports.
See
Tenable One
In Action
Exposure management for the modern attack surface.
See Tenable Attack Surface Management In Action
Formerly Tenable.asm
Know the exposure of every asset on any platform.
Thank You
Thank you for your interest in Tenable Attack Surface Management. A representative will be in touch soon.
Try Tenable Nessus Expert Free
FREE FOR 7 DAYS
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.
Buy Tenable Nessus Expert
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
Try Nessus Expert Free
FREE FOR 7 DAYS
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.
Buy Tenable Nessus Expert
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
如有侵权请联系:admin#unsafe.sh