Thursday, December 7, 2023
HomeCyber SecurityPatch Tuesday, October 2023 Version – Krebs on Safety

Patch Tuesday, October 2023 Version – Krebs on Safety

Microsoft as we speak issued safety updates for greater than 100 newly-discovered vulnerabilities in its Home windows working system and associated software program, together with 4 flaws which can be already being exploited. As well as, Apple lately launched emergency updates to quash a pair of zero-day bugs in iOS.

Apple final week shipped emergency updates in iOS 17.0.3 and iPadOS 17.0.3 in response to energetic assaults. The patch fixes CVE-2023-42724, which attackers have been utilizing in focused assaults to raise their entry on an area machine.

Apple mentioned it additionally patched CVE-2023-5217, which isn’t listed as a zero-day bug. Nevertheless, as Bleeping Pc identified, this flaw is attributable to a weak point within the open-source “libvpx” video codec library, which was beforehand patched as a zero-day flaw by Google within the Chrome browser and by Microsoft in Edge, Groups, and Skype merchandise. For anybody conserving depend, that is the seventeenth zero-day flaw that Apple has patched to date this 12 months.

Fortuitously, the zero-days affecting Microsoft prospects this month are considerably much less extreme than ordinary, apart from CVE-2023-44487. This weak point will not be particular to Home windows however as a substitute exists throughout the HTTP/2 protocol utilized by the World Broad Net: Attackers have discovered easy methods to use a characteristic of HTTP/2 to massively improve the scale of distributed denial-of-service (DDoS) assaults, and these monster assaults reportedly have been happening for a number of weeks now.

Amazon, Cloudflare and Google all launched advisories as we speak about how they’re addressing CVE-2023-44487 of their cloud environments. Google’s Damian Menscher wrote on Twitter/X that the exploit — dubbed a “speedy reset assault” — works by sending a request after which instantly cancelling it (a characteristic of HTTP/2). “This lets attackers skip ready for responses, leading to a extra environment friendly assault,” Menscher defined.

Natalie Silva, lead safety engineer at Immersive Labs, mentioned this flaw’s influence to enterprise prospects might be important, and result in extended downtime.

“It’s essential for organizations to use the most recent patches and updates from their internet server distributors to mitigate this vulnerability and defend in opposition to such assaults,” Silva mentioned. On this month’s Patch Tuesday launch by Microsoft, they’ve launched each an replace to this vulnerability, in addition to a short lived workaround must you not be capable to patch instantly.”

Microsoft additionally patched zero-day bugs in Skype for Enterprise (CVE-2023-41763) and Wordpad (CVE-2023-36563). The latter vulnerability may expose NTLM hashes, that are used for authentication in Home windows environments.

“It could or might not be a coincidence that Microsoft introduced final month that WordPad is not being up to date, and might be eliminated in a future model of Home windows, though no particular timeline has but been given,” mentioned Adam Barnett, lead software program engineer at Rapid7. “Unsurprisingly, Microsoft recommends Phrase as a alternative for WordPad.”

Different notable bugs addressed by Microsoft embody CVE-2023-35349, a distant code execution weak point within the Message Queuing (MSMQ) service, a know-how that enables purposes throughout a number of servers or hosts to speak with one another. This vulnerability has earned a CVSS severity rating of 9.8 (10 is the worst doable). Fortunately, the MSMQ service will not be enabled by default in Home windows, though Immersive Labs notes that Microsoft Trade Server can allow this service throughout set up.

Talking of Trade, Microsoft additionally patched CVE-2023-36778,  a vulnerability in all present variations of Trade Server that might enable attackers to run code of their selecting. Rapid7’s Barnett mentioned profitable exploitation requires that the attacker be on the identical community because the Trade Server host, and use legitimate credentials for an Trade consumer in a PowerShell session.

For a extra detailed breakdown on the updates launched as we speak, see the SANS Web Storm Heart roundup. If as we speak’s updates trigger any stability or usability points in Home windows, will doubtless have the lowdown on that.

Please think about backing up your information and/or imaging your system earlier than making use of any updates. And be at liberty to pontificate within the feedback for those who expertise any difficulties because of these patches.



Please enter your comment!
Please enter your name here

Most Popular

Recent Comments