Microsoft: Patch Tuesday November 2023 released

Yesterday, Microsoft released the November 2023 Patch Tuesday, which includes security for about 60 vulnerabilities. Five of these vulnerabilities are zero-days.

Microsoft Patch Tuesday is a practice followed by Microsoft, where on the second Tuesday of each month it releases updates and fixes for its operating systems , programs and applications. These updates usually include security fixes, performance improvements and new features. The purpose of Microsoft Patch Tuesday is to provide Microsoft users with the best possible user experience by fixing problems and ensuring the security of their systems.

Microsoft Patch Tuesday is important for several reasons. First, security updates help protect systems from vulnerabilities and malware. These updates fix known security issues and make systems more resilient to attacks.

See also: QNAP patches critical command injection vulnerabilities in QTS OS

The new Patch Tuesday patch fixes fourteen remote code execution (RCE) vulnerabilities , but Microsoft only rated one as critical. The other two critical vulnerabilities are one that allows disclosure information and another that leads to execution of programs on the host with SYSTEM privileges.

The categories of vulnerabilities fixed in Microsoft's November Patch Tuesday are:

• 16 vulnerabilities that allow for elevation of privilege
• 15 vulnerabilities that allow remote code execution
• 11 spoofing vulnerabilities
• 6 vulnerabilities that allow security features to be bypassed
• 6 vulnerabilities that allow information disclosure
• 5 vulnerabilities that allow Denial of Service attacks

5 zero-day vulnerabilities

Microsoft Patch Tuesday November 2023 fixes five zero-day vulnerabilities. Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited without an official patch being released. Here, we have both cases.

See also: Veeam patches serious vulnerabilities in Veeam ONE

Three zero-day vulnerabilities have been used in attacks:

CVE-2023-36036 – Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft has fixed a bug in the Windows Cloud Files Mini Filterthat could allow attackers to gain elevated privileges on the vulnerable system.

“An attacker who successfully exploited this vulnerability could gain SYSTEM,” Microsoft explains.

It is not known how the bug was exploited in attacks. We also do not know who exploited the vulnerability.

The vulnerability was discovered internally by the Microsoft Threat Intelligence Security Response Center.

CVE-2023-36033 – Windows DWM Core Library Elevation of Privilege Vulnerability

This Patch Tuesday, Microsoft is also fixing another zero-day vulnerability in the Windows DWM Core Library that also allows elevation of privilege to SYSTEM. This vulnerability has been exploited in attacks and has been publicly disclosed.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft explains.

Microsoft says the flaw was discovered by Quan Jin(@jq0904) from DBAPPsecurity WeBin Lab, but did not share details about how it was used in attacks.

CVE-2023-36025 – Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft has also fixed a bug in Windows SmartScreen that was exploited by cybercriminals and allows a malicious Internet Shortcut to bypass security checks and warnings.

“The attacker could bypass Windows Defender SmartScreen checks and related prompts,” Microsoft explains.

“The user would have to click on a specially crafted Internet Shortcut (.URL) or a hyperlink that points to an Internet Shortcut file to be compromised by the attacker,” Microsoft continues.

Microsoft says the flaw was discovered by Will Metcalf (Splunk), Microsoft Threat Intelligence, and the Microsoft Office Product Group Security Team.

See also: Citrix: Immediate action to fix critical issue in NetScaler

The latest zero-day vulnerabilities fixed with Microsoft's November Patch Tuesday are:

CVE-2023-36413 – Microsoft Office Security Feature Bypass Vulnerability

A vulnerability in Microsoft Office that allows the bypass of security.

CVE-2023-36038 — CVE-2023-36038 — ASP.NET Core Denial of Service Vulnerability

A vulnerability that allows Denial of Service attacks.

However, Microsoft says that these vulnerabilities have not been used in attacks. They have simply been publicly disclosed.

Microsoft Patch Tuesday November 2023

In the table below, you can see in detail the vulnerabilities that Microsoft fixed this month:

Source: www.bleepingcomputer.com