www.darkreading.com
Open in
urlscan Pro
2606:4700::6811:7663
Public Scan
URL:
https://www.darkreading.com/vulnerabilities-threats/microsoft-patches-two-zero-day-vulnerabilities
Submission: On May 10 via api from TR — Scanned from DE
Submission: On May 10 via api from TR — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches
Cloud
ICS/OT
Remote Workforce
Perimeter
Analytics
Security Monitoring
Security Monitoring
App Sec
Database Security
Database Security
Risk
Compliance
Compliance
Threat Intelligence
Endpoint
AuthenticationMobile SecurityPrivacy
AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management
Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People
Identity & Access ManagementCareers & People
Physical Security
IoT
DR Global
Middle East & Africa
Middle East & Africa
Black Hat news
Omdia Research
Security Now
Events
Close
Back
Events
Events
* Anatomy of a Data Breach - A Dark Reading June 22 Event
* Black Hat USA - August 5-10 - Learn More
Webinars
* Unleashing AI to Assess Cybersecurity Risk
May 11, 2023
* Puzzled by Patching: Solve Endpoint Pains
May 16, 2023
Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >
Newsletter Sign-Up
The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches
Cloud
ICS/OT
Remote Workforce
Perimeter
Analytics
Security Monitoring
Security Monitoring
App Sec
Database Security
Database Security
Risk
Compliance
Compliance
Threat Intelligence
Endpoint
AuthenticationMobile SecurityPrivacy
AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management
Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People
Identity & Access ManagementCareers & People
Physical Security
IoT
DR Global
Middle East & Africa
Middle East & Africa
Black Hat news
Omdia Research
Security Now
Events
Close
Back
Events
Events
* Anatomy of a Data Breach - A Dark Reading June 22 Event
* Black Hat USA - August 5-10 - Learn More
Webinars
* Unleashing AI to Assess Cybersecurity Risk
May 11, 2023
* Puzzled by Patching: Solve Endpoint Pains
May 16, 2023
Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >
The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches
Cloud
ICS/OT
Remote Workforce
Perimeter
Analytics
Security Monitoring
Security Monitoring
App Sec
Database Security
Database Security
Risk
Compliance
Compliance
Threat Intelligence
Endpoint
AuthenticationMobile SecurityPrivacy
AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management
Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People
Identity & Access ManagementCareers & People
Physical Security
IoT
DR Global
Middle East & Africa
Middle East & Africa
Black Hat news
Omdia Research
Security Now
Events
Close
Back
Events
Events
* Anatomy of a Data Breach - A Dark Reading June 22 Event
* Black Hat USA - August 5-10 - Learn More
Webinars
* Unleashing AI to Assess Cybersecurity Risk
May 11, 2023
* Puzzled by Patching: Solve Endpoint Pains
May 16, 2023
Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >
--------------------------------------------------------------------------------
Newsletter Sign-Up
SEARCH
A minimum of 3 characters are required to be typed in the search bar in order to
perform a search.
Announcements
1.
2.
3.
Event
How to Launch a Threat Hunting Program | Webinar <REGISTER>
Event
How to Accelerate XDR Outcomes: Bridging the Gap Between Network and Endpoint |
Webinar <REGISTER>
Report
Black Hat USA 2022 Attendee Report | Supply Chain & Cloud Security Risks Are Top
of Mind | <READ IT NOW>
PreviousNext
Vulnerabilities/Threats
4 MIN READ
News
MICROSOFT PATCHES 2 ZERO-DAY VULNERABILITIES
The 49 CVE's in Microsoft's May security update is the lowest volume in nearly
two years.
Jai Vijayan
Contributing Writer, Dark Reading
May 09, 2023
Source: shaneinsweden via Shutterstock
PDF
Microsoft's security update for May 2023 is the lightest in volume since August
2021 with fixes for a total of 49 new vulnerabilities including two that
attackers are actively exploiting.
The update includes fixes for nine vulnerabilities in the open-source Chromium
engine on which Microsoft's Edge browser is based. The company identified seven
of the remaining 40 vulnerabilities as being of critical severity and the rest
as being "important".
ACTIVELY EXPLOITED FLAWS
The two actively exploited vulnerabilities that Microsoft fixed in its May
update marks the fifth straight month the company has disclosed at least one
zero-day bug on Patch Tuesday. One of the new zero-days this month is a Win32k
privilege escalation vulnerability tracked as (CVE-2023-29336) that attackers
can exploit to gain complete control of affected systems.
The fact that it was an anti-malware vendor — Avast — that reported the bug to
Microsoft suggests that threat actors are using the bug to distribute malware,
researchers at Trend Micro's Zero Day Initiative (ZDI) said in a blog post.
"This type of privilege escalation is usually combined with a code execution bug
to spread malware," ZDI said. "As always, Microsoft offers no information about
how widespread these attacks may be."
Currently, there are no workarounds or alternative fixes available for the flaw,
which means patching is the most effective way to mitigate risk, said M.
Walters, vice president of vulnerability and threat research at Action 1 in
emailed comments. "In light of this, it is absolutely crucial to promptly update
systems with the provided patches," Walters advised.
The second bug in this month's update that attackers are currently exploiting is
a security feature bypass vulnerability in the Windows Secure Boot feature for
protecting the boot process from unauthorized changes and malicious software
during system startup.
The bug, identified as CVE-2023-24932, allows an attacker to bypass Secure Boot
and install a boot policy of their choice. An attacker would need physical
access or administrative rights on an affected machine to exploit the flaw.
Satnam Narang, senior staff engineer at Tenable, said the flaw appears related
to BlackLotus, a UEFI bootkit that security vendor ESET first reported on in
March 2023.
A SLEW OF RCES — AGAIN
Nearly one-quarter, or 12 of the vulnerabilities that Microsoft disclosed in its
May 2023 update enable remote code execution; eight are information disclosure
flaws; and six let attackers bypass security controls.
The RCEs affect Microsoft's Network File System (NFS) protocol for file sharing
and remote access over a network; the Windows Pragmatic General Multicast (PGM);
Windows Bluetooth Driver; and the Windows Lightweight Directory Access Protocol
(LDAP).
Several security vendors identified an RCE in Microsoft NFS (CVE-2023-24941) as
one that organizations need to prioritize due to the risk it presents. Microsoft
has assigned the CVE a severity score of 9.8 — the highest in the May update —
because of the low attack complexity associated with the bug, and also the fact
that it requires no user interaction. An attacker with low privileges could
exploit the flaw over the network via an unauthenticated, specially crafted call
to an NFS service, Microsoft said.
The company has released a mitigation for the vulnerability. But it cautioned
organizations from using the mitigation if they have not already installed the
patch for a previous flaw in NFSV2.0 and NFSV3.0 (CVE-2022-26937) that Microsoft
patched in May 2022.
"The NFS protocol is more common in Linux and Unix environments than in Windows,
where SMB protocol is more common," said Yoav Iellin, senior researcher,
Silverfort, in an emailed comment. "Even so, organizations using Windows server
as their NFS server should consider applying Microsoft's fix promptly," Iellin
said.
OTHER CRITICAL BUGS
The SANS Internet Storm Center pointed to CVE-2023-28283, an RCE in Windows LDAP
as another bug in May's set that organization should pay attention to even
though Microsoft itself has assessed the bug as less likely to be exploited. The
vulnerability gives attackers a way to gain RCE within the context of the LDAP
service via specially crafted LDAP calls.
An unauthenticated attacker who successfully exploited this vulnerability could
gain code execution through a specially crafted set of LDAP calls to execute
arbitrary code within the context of the LDAP service. But attacking the
vulnerability involves a high degree of complexity, SANS said.
One of the critical flaws that Microsoft described as more likely to be
exploited because proof-of concept code for it is already available, is
CVE-2023-29325, an RCE in Windows Object Linking and Embedding (OLE) technology.
An attacker can trigger the flaw by sending a specially crafted email to a
victim and having the victim either opening the email with an affected version
of Microsoft Outlook, or simply viewing it in the preview pane.
"The simple act of glancing at a carefully crafted malicious email in Outlook's
preview pane is enough to enable remote code execution and potentially
compromise the recipient's computer," Iellin said.
Microsoft recommends that users read email in plain text format to protect
against the flaw until they patch the issue. The company also provided guidance
on how administrators can configure Outlook to read all standard email in plain
text.
Threat Intelligence
Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities,
data breach information, and emerging trends. Delivered daily or weekly right to
your email inbox.
Subscribe
More Insights
White Papers
*
ESG Report: Automated Application Security Testing for Faster Development
*
Top 5 Reasons to Prioritize Privileged Access Management
More White Papers
Webinars
*
Unleashing AI to Assess Cybersecurity Risk
*
Puzzled by Patching: Solve Endpoint Pains
More Webinars
Reports
*
Successfully Managing Identity in Modern Cloud and Hybrid Environments
*
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
More Reports
Editors' Choice
7 Things Your Ransomware Response Playbook Is Likely Missing
Becky Bracken, Editor, Dark Reading
Samsung Engineers Feed Sensitive Data to ChatGPT, Sparking Workplace AI Warnings
Jai Vijayan, Contributing Writer, Dark Reading
LastPass Breach Reveals Important Lessons
Mike Walters, VP of Vulnerability and Threat Research & Co-Founder, Action1
Corporation
FIN7, Former Conti Gang Members Collaborate on 'Domino' Malware
Jai Vijayan, Contributing Writer, Dark Reading
Webinars
* Unleashing AI to Assess Cybersecurity Risk
* Puzzled by Patching: Solve Endpoint Pains
* Building the SOC of the Future: Next-Gen Security Operations
* Everything you Need to Know about DNS Attacks
* Why Threat Modeling Is Critical for Enterprise Cyber Defense
More Webinars
Reports
* Successfully Managing Identity in Modern Cloud and Hybrid Environments
* The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
* Shoring Up the Software Supply Chain Across Enterprise Applications
* The Promise and Reality of Cloud Security
* 10 Hot Talks From Black Hat USA 2022
More Reports
White Papers
* ESG Report: Automated Application Security Testing for Faster Development
* Top 5 Reasons to Prioritize Privileged Access Management
* The Big Business Of Cybercrime: A Deep Dive Guide
* 2023 Gartner Market Guide for Cloud-Native Application Protection Platforms
(CNAPP)
* 2023 Cloud Threat Report
More White Papers
Events
* Anatomy of a Data Breach - A Dark Reading June 22 Event
* Black Hat USA - August 5-10 - Learn More
More Events
More Insights
White Papers
*
ESG Report: Automated Application Security Testing for Faster Development
*
Top 5 Reasons to Prioritize Privileged Access Management
More White Papers
Webinars
*
Unleashing AI to Assess Cybersecurity Risk
*
Puzzled by Patching: Solve Endpoint Pains
More Webinars
Reports
*
Successfully Managing Identity in Modern Cloud and Hybrid Environments
*
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
More Reports
DISCOVER MORE FROM INFORMA TECH
* Interop
* InformationWeek
* Network Computing
* ITPro Today
* Data Center Knowledge
* Black Hat
* Omdia
WORKING WITH US
* About Us
* Advertise
* Reprints
FOLLOW DARK READING ON SOCIAL
*
*
*
*
*
*
* Home
* Cookies
* Privacy
* Terms
Copyright © 2023 Informa PLC Informa UK Limited is a company registered in
England and Wales with company number 1072954 whose registered office is 5
Howick Place, London, SW1P 1WG.
Cookies Button
ABOUT COOKIES ON THIS SITE
We and our partners use cookies to enhance your website experience, learn how
our site is used, offer personalised features, measure the effectiveness of our
services, and tailor content and ads to your interests while you navigate on the
web or interact with us across devices. You can choose to accept all of these
cookies or only essential cookies. To learn more or manage your preferences,
click “Settings”. For further information about the data we collect from you,
please see our Privacy Policy
Accept All
Settings
COOKIE PREFERENCE CENTER
When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All
MANAGE CONSENT PREFERENCES
STRICTLY NECESSARY COOKIES
Always Active
These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.
Cookies Details
PERFORMANCE COOKIES
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.
Cookies Details
FUNCTIONAL COOKIES
Functional Cookies
These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then
some or all of these services may not function properly.
Cookies Details
TARGETING COOKIES
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.
Cookies Details
Back Button
BACK
Search Icon
Filter Icon
Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label
*
View Cookies
* Name
cookie name
Confirm My Choices