This major July update includes fixes for 130 unique vulnerabilities that affect a variety of products, including Windows, Office, .Net, and Azure Active Directory, among others.
Microsoft’s July security update contains fixes for a whopping 130 unique vulnerabilities. The company has rated nine of the flaws as critical, and 121 of them as moderate or important.
The vulnerabilities affect a wide range of Microsoft products, including Windows, Office, .Net, Azure Active Directory, print drivers, DMS, and remote desktop servers. The update contains the usual mix of Remote Code Execution (RCE) flaws, security bypasses and privilege escalation issues, information disclosure bugs, and Denial of Service (DoS) vulnerabilities.
“This is the largest patch rollout we’ve seen in years, although it’s not unusual to see Microsoft push out a large number of patches right before Black Hat USA,” Dustin Childs, a security researcher at Trend Micro’s Zero Day Initiative (ZDI), said in a blog post.
The most serious threat is called CVE-2023-36884 , a remote code execution (RCE) bug in Office and Windows HTML, for which Microsoft did not have a patch in this month’s update. The company has identified a group of threats called Storm-0978, which it is monitoring, that exploit a flaw in a phishing campaign targeting government and defense organizations in North America and Europe.
The campaign involves the attacker distributing a backdoor, dubbed RomCom, via Windows documents that cover topics related to the Ukrainian World Congress. “Targeted operations of Storm-0978 have impacted government and military organizations primarily in Ukraine, as well as organizations in Europe and North America potentially involved in Ukrainian affairs,” Microsoft said in a blog post that accompanied the July security update. “The identified ransomware attacks have impacted the telecommunications and finance sectors, among other things.”
Two of the five vulnerabilities, which are being actively exploited, are security bypass flaws. One involves Microsoft Outlook ( CVE-2023-35311 ) and the other involves Windows SmartScreen ( CVE-2023-32049 ). Both vulnerabilities require user interaction, meaning an attacker could only exploit them by convincing a user to click a malicious URL. The latter vulnerability would allow an attacker to bypass the Open File – Security Warning prompt, and it is thought that attackers will likely be able to use it as part of a larger attack chain, while CVE-2023-35311 gives attackers a way to bypass their attack via the Microsoft Outlook Security Warning prompt.
“It is important to note that CVE-2023-35311 specifically allows attackers to bypass Microsoft Outlook’s security features and does not enable remote code execution or escalation of privilege,” said Mike Walters, vice president of vulnerability and threat research at Action1. “Therefore, attackers are likely to combine it with other exploits for a more comprehensive attack. The vulnerability affects all versions of Microsoft Outlook from 2013 onwards.
The other two zero-days in Microsoft’s latest patch set both enable privilege escalation. Researchers at Google’s Threat Analysis Group have discovered one of them. The flaw, an elevation of privilege issue in the WER service (Windows Error Reporting, WER is a feature of Microsoft Windows operating systems that automatically collects and sends error reports to Microsoft when certain software crashes or encounters other types of errors), which gives attackers a way to gain administrative rights on vulnerable systems.
The other elevation of privilege bug in the July security update, which attackers are already actively exploiting, is CVE-2023-32046 in Microsoft’s Windows MSHTM platform, also known as the “Trident” browser rendering engine. Like many other bugs, this one requires some level of user interaction. In an email attack scenario, an attacker would have to send a targeted user a specially crafted file and ask the user to open it to exploit the bug. In a web-based attack, an attacker would have to host a malicious website or use a compromised website to host a specially crafted file and then convince a victim to open it, according to Microsoft.
Security researchers have singled out three RCE vulnerabilities in Windows Routing and Remote Access Service (RRAS) as requiring priority attention, with Microsoft rating all three as critical. The service is not available by default on Windows Server and essentially allows computers running the operating system to function as routers, VPN servers, and dial-up servers, an attacker could change network configurations, steal data, switch to other more critical/important systems, or create additional accounts for permanent access to the device.
Microsoft’s massive July update contains fixes for four RCE vulnerabilities in SharePoint Server, which has recently become a popular target for hackers. Microsoft has rated two of the bugs as “important” and the other two as “critical.” “All require the attacker to be authenticated or for the user to take an action, which fortunately reduces the risk of a breach.
Additionally, Microsoft has posted a notice about its investigation into recent reports of hackers using drivers certified by Microsoft’s Windows Hardware Developer Program (MWHDP) in post-exploit activity.
This major July update includes fixes for 130 unique vulnerabilities that affect a variety of products, including Windows, Office, .Net, and Azure Active Directory, among others.
Microsoft’s July security update contains fixes for a whopping 130 unique vulnerabilities. The company has rated nine of the flaws as critical, and 121 of them as moderate or important.
The vulnerabilities affect a wide range of Microsoft products, including Windows, Office, .Net, Azure Active Directory, print drivers, DMS, and remote desktop servers. The update contains the usual mix of Remote Code Execution (RCE) flaws, security bypasses and privilege escalation issues, information disclosure bugs, and Denial of Service (DoS) vulnerabilities.
“This is the largest patch rollout we’ve seen in years, although it’s not unusual to see Microsoft push out a large number of patches right before Black Hat USA,” Dustin Childs, a security researcher at Trend Micro’s Zero Day Initiative (ZDI), said in a blog post.
The most serious threat is called CVE-2023-36884 , a remote code execution (RCE) bug in Office and Windows HTML, for which Microsoft did not have a patch in this month’s update. The company has identified a group of threats called Storm-0978, which it is monitoring, that exploit a flaw in a phishing campaign targeting government and defense organizations in North America and Europe.
The campaign involves the attacker distributing a backdoor, dubbed RomCom, via Windows documents that cover topics related to the Ukrainian World Congress. “Targeted operations of Storm-0978 have impacted government and military organizations primarily in Ukraine, as well as organizations in Europe and North America potentially involved in Ukrainian affairs,” Microsoft said in a blog post that accompanied the July security update. “The identified ransomware attacks have impacted the telecommunications and finance sectors, among other things.”
Two of the five vulnerabilities, which are being actively exploited, are security bypass flaws. One involves Microsoft Outlook ( CVE-2023-35311 ) and the other involves Windows SmartScreen ( CVE-2023-32049 ). Both vulnerabilities require user interaction, meaning an attacker could only exploit them by convincing a user to click a malicious URL. The latter vulnerability would allow an attacker to bypass the Open File – Security Warning prompt, and it is thought that attackers will likely be able to use it as part of a larger attack chain, while CVE-2023-35311 gives attackers a way to bypass their attack via the Microsoft Outlook Security Warning prompt.
“It is important to note that CVE-2023-35311 specifically allows attackers to bypass Microsoft Outlook’s security features and does not enable remote code execution or escalation of privilege,” said Mike Walters, vice president of vulnerability and threat research at Action1. “Therefore, attackers are likely to combine it with other exploits for a more comprehensive attack. The vulnerability affects all versions of Microsoft Outlook from 2013 onwards.
The other two zero-days in Microsoft’s latest patch set both enable privilege escalation. Researchers at Google’s Threat Analysis Group have discovered one of them. The flaw, an elevation of privilege issue in the WER service (Windows Error Reporting, WER is a feature of Microsoft Windows operating systems that automatically collects and sends error reports to Microsoft when certain software crashes or encounters other types of errors), which gives attackers a way to gain administrative rights on vulnerable systems.
The other elevation of privilege bug in the July security update, which attackers are already actively exploiting, is CVE-2023-32046 in Microsoft’s Windows MSHTM platform, also known as the “Trident” browser rendering engine. Like many other bugs, this one requires some level of user interaction. In an email attack scenario, an attacker would have to send a targeted user a specially crafted file and ask the user to open it to exploit the bug. In a web-based attack, an attacker would have to host a malicious website or use a compromised website to host a specially crafted file and then convince a victim to open it, according to Microsoft.
Security researchers have singled out three RCE vulnerabilities in Windows Routing and Remote Access Service (RRAS) as requiring priority attention, with Microsoft rating all three as critical. The service is not available by default on Windows Server and essentially allows computers running the operating system to function as routers, VPN servers, and dial-up servers, an attacker could change network configurations, steal data, switch to other more critical/important systems, or create additional accounts for permanent access to the device.
Microsoft’s massive July update contains fixes for four RCE vulnerabilities in SharePoint Server, which has recently become a popular target for hackers. Microsoft has rated two of the bugs as “important” and the other two as “critical.” “All require the attacker to be authenticated or for the user to take an action, which fortunately reduces the risk of a breach.
Additionally, Microsoft has posted a notice about its investigation into recent reports of hackers using drivers certified by Microsoft’s Windows Hardware Developer Program (MWHDP) in post-exploit activity.