Microsoft Patch Tuesday October 2023: Fixes 104 bugs

Yesterday, Microsoft released Patch Tuesday October 2023, its monthly security updates, which this time patched 104 vulnerabilities. Among them are three zero-day bugs that have been used in attacks.

While a total of 45 remote code execution (RCE) vulnerabilities were patched , Microsoft only rated twelve vulnerabilities as ' Critical '. All 12 are RCEs.

In the list below, you can see the categories of bugs fixed with Patch Tuesday October 2023:

• 45 vulnerabilities that allow remote code execution
• 26 vulnerabilities that allow for the acquisition of more privileges in the system
• 17 vulnerabilities for Denial of Service attacks
• 12 vulnerabilities that allow information disclosure
• 3 vulnerabilities that allow security checks to be bypassed
• 1 vulnerability for Spoofing attacks

These numbers do not include a Chromium (CVE-2023-5346), which was patched by Google on October 3 and ported to Microsoft Edge.

See also: Cisco fixes vulnerability in Cisco Emergency Responder

Microsoft Patch Tuesday October 2023: Zero-day vulnerabilities

This month's Patch Tuesday fixes three zero-day vulnerabilities that have been used in attacks. Two of them were publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it has been publicly disclosed or used in attacks, without an official fix available.

CVE-2023-41763  – Skype for Business Elevation of Privilege Vulnerability

Microsoft has fixed a Skype for Business, classified as an Elevation of Privileges bug.

“An attacker who successfully exploited the vulnerability could see some sensitive information (Confidentiality), but not all resources within the affected component could be disclosed,” Microsoft explains.

“The attacker cannot make changes to the disclosed information (Integrity) or restrict access to the resource (Availability)“.

The vulnerability was discovered by Dr. Florian Hauser (@frycos), who told BleepingComputer that he had reported this vulnerability to Microsoft since September 2022. However, the company had not patched it until now.

See also: ShellTorch: Vulnerabilities allow code execution attacks on AI servers 

CVE-2023-36563 – Microsoft WordPad Information Disclosure Vulnerability

Microsoft has fixed a vulnerability that could be used to steal NTLM hashes when opening a document in WordPad.

“To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of a system,” Microsoft explains.

“In addition, an attacker could convince a local user to open a malicious file. The attacker would have to convince the user to click on a link, in an email or instant message, and then convince the user to open the specially crafted file“.

These NTLM hashes can be cracked or used in NTLM Relay attacks to gain access to the account.

The vulnerability was discovered by Microsoft's own researchers and appears to be an offshoot of CVE-2023-36761, which was patched last month.

CVE-2023-44487 – HTTP/2 Rapid Reset Attack

Microsoft has released mitigations for a new zero-day DDoS attack technique, called “HTTP/2 Rapid Reset,” that has been actively used since August.

This attack abuses the stream cancellation feature of HTTP/2 to continuously send and cancel requests, overwhelming the target server/application and forcing a DoS condition.

As the feature is built into the HTTP/2 standard, there is no “fix” for the technique that can be implemented. The only thing that can be done is to limit or block the protocol.

According to Microsoft, you should disable the HTTP/2 protocol on your web server.

However, the company has now provided more details, explaining that this bug was revealed as part of a coordinated disclosure by Cloudflare, Amazon , and Google.

See also: Exim: Fixes three zero-day vulnerabilities

Microsoft Patch Tuesday October 2023: All vulnerabilities fixed

In the table below, you can see all the vulnerabilities being fixed this month:

Microsoft Patch Tuesday October 2023: Fixes 104 vulnerabilities

As part of its commitment to continuously maintaining the security of its products, Microsoft releases Patch Tuesday each month, providing enhanced protection to its users. These updates fix critical vulnerabilities that could expose users' systems to risk.

Patch Tuesday is a major Microsoft initiative to achieve the most secure platform. It is released every second Tuesday of the month and includes the release of updates for all vulnerable Microsoft products. 

While systematically releasing patches is undoubtedly important for security, it's worth noting that we should also implement other basic security, such as using strong passwords, creating backups, using reliable antivirus software, using a firewall, and more.

Source: www.bleepingcomputer.com