Microsoft Patch Tuesday

In today’s SensCy Cyber Brief, your SensCy team reviewed Microsoft’s latest series of patches released on Tuesday, October 10, 2023. Today’s Patch Tuesday comes with fixes for Three Zero-Day vulnerability and and 104 flaws.

What is Patch Tuesday?
Patch Tuesday is Microsoft’s initiative to release new security fixes for the Windows operating system and any other Microsoft software on a monthly basis. Your SensCy team will monitor such releases and provide you with our observations and recommendations.

Why is it important?
This month’s patch Tuesday is critical because it fixes TWO zero-day vulnerabilities (a vulnerability in a system or device that has been disclosed but is not yet patched). The SensCy team recommends Microsoft users install those patches immediately.

CVE-2023-41763 is a Skype for Business Elevation of Privilege. “An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality) but not all resources within the impacted component may be divulged to the attacker.,” explains Microsoft.

CVE-2023-36563 is a Microsoft WordPad Information Disclosure Vulnerability. “To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system,” explains Microsoft.

CVE-2023-44487 is a HTTP/2 Rapid request Attack. There is no “fix” for this issue. Microsoft’s mitigation steps in the advisory are to disable the HTTP/2 protocol on your web server. However, they also provided a dedicated article on HTTP/2 Rapid Reset, with further information.

In addition to the zero-day fix, Microsoft is also fixing 104 vulnerabilities, with Five classified as “Critical” as they allow remote code execution.
Here is a breakdown of each vulnerability category:

• 26 Elevation of Privilege Vulnerability
• 3 Security Feature Bypass Vulnerabilities
• 45 Remote Code Execution Vulnerabilities
• 12 Information Disclosure Vulnerabilities
• 17 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerabilities

For more information on vulnerabilities and the system that it affects, please refer to the full report from Microsoft linked here.