Microsoft has just rolled out its latest set of updates as part of the November 2023 Patch Tuesday, addressing over sixty security vulnerabilities across Windows operating systems and associated software. Notably, this release contains patches for three zero-day vulnerabilities, indicating that these flaws are already actively exploited.
1. CVE-2023-36025: Windows SmartScreen Bypass
The first zero-day vulnerability, CVE-2023-36025, targets the Windows SmartScreen Security feature. This weakness allows malicious content to circumvent SmartScreen, a critical component that identifies and blocks malicious websites and files. Microsoft warns that attackers may exploit this flaw by enticing Windows users to click on a compromised link leading to a shortcut file. Threat researchers emphasize the importance of scrutinizing emails with .url attachments, as they might be vectors for exploiting this vulnerability.
2. CVE-2023-36033: DWM Core Library Exploitation
The second zero-day, CVE-2023-36033, affects the “DWM Core Library” in Microsoft Windows. This vulnerability has been observed in the wild as a zero-day and was publicly disclosed before patches became available. It impacts Windows 10 and later versions, as well as Windows Server 2019 and subsequent editions. This local exploit, characterized by low complexity and not requiring high-level privileges or user interaction, can potentially grant attackers SYSTEM privileges, making it a potent method for privilege escalation.
3. CVE-2023-36036: Windows Cloud Files Mini Filter Driver Vulnerability
The final zero-day for this month, CVE-2023-36036, pertains to the “Windows Cloud Files Mini Filter Driver.” This vulnerability affects Windows 10 and later, as well as Windows Server 2008 and later versions. Microsoft notes that attackers can easily exploit this flaw to elevate their privileges on a compromised PC.
Additional Prioritized Patches
Apart from the zero-day vulnerabilities, organizations using Microsoft Exchange Server should prioritize several new Exchange patches. CVE-2023-36439 stands out, enabling attackers to install malicious software on an Exchange server. Although it requires the attacker to be authenticated to the target’s local network, security experts highlight the risk associated with compromised Exchange credentials obtained through phishing attacks.
Additionally, there are three Exchange bugs deemed “exploitation more likely”: CVE-2023-36050, CVE-2023-36039, and CVE-2023-36035.
The SANS Internet Storm Center draws attention to two other patched vulnerabilities: CVE-2023-36038, a denial of service vulnerability in ASP.NET Core, and CVE-2023-36413, a Microsoft Office security feature bypass. While not currently showing signs of active exploitation, these deserve attention due to their pre-existing public disclosure.
As a general precaution, Windows users are advised to consider backing up their data or imaging their systems before applying updates. Users are encouraged to share their experiences in the comments if any difficulties arise from these patches.