www.darkreading.com
Open in
urlscan Pro
2606:4700::6811:7663
Public Scan
URL:
https://www.darkreading.com/vulnerabilities-threats/microsoft-patches-two-zero-day-vulnerabilities
Submission: On May 10 via api from TR — Scanned from DE
Submission: On May 10 via api from TR — Scanned from DE
Form analysis
0 forms found in the DOMText Content
The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Security Now Events Close Back Events Events * Anatomy of a Data Breach - A Dark Reading June 22 Event * Black Hat USA - August 5-10 - Learn More Webinars * Unleashing AI to Assess Cybersecurity Risk May 11, 2023 * Puzzled by Patching: Solve Endpoint Pains May 16, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > Newsletter Sign-Up The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Security Now Events Close Back Events Events * Anatomy of a Data Breach - A Dark Reading June 22 Event * Black Hat USA - August 5-10 - Learn More Webinars * Unleashing AI to Assess Cybersecurity Risk May 11, 2023 * Puzzled by Patching: Solve Endpoint Pains May 16, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Security Now Events Close Back Events Events * Anatomy of a Data Breach - A Dark Reading June 22 Event * Black Hat USA - August 5-10 - Learn More Webinars * Unleashing AI to Assess Cybersecurity Risk May 11, 2023 * Puzzled by Patching: Solve Endpoint Pains May 16, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > -------------------------------------------------------------------------------- Newsletter Sign-Up SEARCH A minimum of 3 characters are required to be typed in the search bar in order to perform a search. Announcements 1. 2. 3. Event How to Launch a Threat Hunting Program | Webinar <REGISTER> Event How to Accelerate XDR Outcomes: Bridging the Gap Between Network and Endpoint | Webinar <REGISTER> Report Black Hat USA 2022 Attendee Report | Supply Chain & Cloud Security Risks Are Top of Mind | <READ IT NOW> PreviousNext Vulnerabilities/Threats 4 MIN READ News MICROSOFT PATCHES 2 ZERO-DAY VULNERABILITIES The 49 CVE's in Microsoft's May security update is the lowest volume in nearly two years. Jai Vijayan Contributing Writer, Dark Reading May 09, 2023 Source: shaneinsweden via Shutterstock PDF Microsoft's security update for May 2023 is the lightest in volume since August 2021 with fixes for a total of 49 new vulnerabilities including two that attackers are actively exploiting. The update includes fixes for nine vulnerabilities in the open-source Chromium engine on which Microsoft's Edge browser is based. The company identified seven of the remaining 40 vulnerabilities as being of critical severity and the rest as being "important". ACTIVELY EXPLOITED FLAWS The two actively exploited vulnerabilities that Microsoft fixed in its May update marks the fifth straight month the company has disclosed at least one zero-day bug on Patch Tuesday. One of the new zero-days this month is a Win32k privilege escalation vulnerability tracked as (CVE-2023-29336) that attackers can exploit to gain complete control of affected systems. The fact that it was an anti-malware vendor — Avast — that reported the bug to Microsoft suggests that threat actors are using the bug to distribute malware, researchers at Trend Micro's Zero Day Initiative (ZDI) said in a blog post. "This type of privilege escalation is usually combined with a code execution bug to spread malware," ZDI said. "As always, Microsoft offers no information about how widespread these attacks may be." Currently, there are no workarounds or alternative fixes available for the flaw, which means patching is the most effective way to mitigate risk, said M. Walters, vice president of vulnerability and threat research at Action 1 in emailed comments. "In light of this, it is absolutely crucial to promptly update systems with the provided patches," Walters advised. The second bug in this month's update that attackers are currently exploiting is a security feature bypass vulnerability in the Windows Secure Boot feature for protecting the boot process from unauthorized changes and malicious software during system startup. The bug, identified as CVE-2023-24932, allows an attacker to bypass Secure Boot and install a boot policy of their choice. An attacker would need physical access or administrative rights on an affected machine to exploit the flaw. Satnam Narang, senior staff engineer at Tenable, said the flaw appears related to BlackLotus, a UEFI bootkit that security vendor ESET first reported on in March 2023. A SLEW OF RCES — AGAIN Nearly one-quarter, or 12 of the vulnerabilities that Microsoft disclosed in its May 2023 update enable remote code execution; eight are information disclosure flaws; and six let attackers bypass security controls. The RCEs affect Microsoft's Network File System (NFS) protocol for file sharing and remote access over a network; the Windows Pragmatic General Multicast (PGM); Windows Bluetooth Driver; and the Windows Lightweight Directory Access Protocol (LDAP). Several security vendors identified an RCE in Microsoft NFS (CVE-2023-24941) as one that organizations need to prioritize due to the risk it presents. Microsoft has assigned the CVE a severity score of 9.8 — the highest in the May update — because of the low attack complexity associated with the bug, and also the fact that it requires no user interaction. An attacker with low privileges could exploit the flaw over the network via an unauthenticated, specially crafted call to an NFS service, Microsoft said. The company has released a mitigation for the vulnerability. But it cautioned organizations from using the mitigation if they have not already installed the patch for a previous flaw in NFSV2.0 and NFSV3.0 (CVE-2022-26937) that Microsoft patched in May 2022. "The NFS protocol is more common in Linux and Unix environments than in Windows, where SMB protocol is more common," said Yoav Iellin, senior researcher, Silverfort, in an emailed comment. "Even so, organizations using Windows server as their NFS server should consider applying Microsoft's fix promptly," Iellin said. OTHER CRITICAL BUGS The SANS Internet Storm Center pointed to CVE-2023-28283, an RCE in Windows LDAP as another bug in May's set that organization should pay attention to even though Microsoft itself has assessed the bug as less likely to be exploited. The vulnerability gives attackers a way to gain RCE within the context of the LDAP service via specially crafted LDAP calls. An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through a specially crafted set of LDAP calls to execute arbitrary code within the context of the LDAP service. But attacking the vulnerability involves a high degree of complexity, SANS said. One of the critical flaws that Microsoft described as more likely to be exploited because proof-of concept code for it is already available, is CVE-2023-29325, an RCE in Windows Object Linking and Embedding (OLE) technology. An attacker can trigger the flaw by sending a specially crafted email to a victim and having the victim either opening the email with an affected version of Microsoft Outlook, or simply viewing it in the preview pane. "The simple act of glancing at a carefully crafted malicious email in Outlook's preview pane is enough to enable remote code execution and potentially compromise the recipient's computer," Iellin said. Microsoft recommends that users read email in plain text format to protect against the flaw until they patch the issue. The company also provided guidance on how administrators can configure Outlook to read all standard email in plain text. Threat Intelligence Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe More Insights White Papers * ESG Report: Automated Application Security Testing for Faster Development * Top 5 Reasons to Prioritize Privileged Access Management More White Papers Webinars * Unleashing AI to Assess Cybersecurity Risk * Puzzled by Patching: Solve Endpoint Pains More Webinars Reports * Successfully Managing Identity in Modern Cloud and Hybrid Environments * The 10 Most Impactful Types of Vulnerabilities for Enterprises Today More Reports Editors' Choice 7 Things Your Ransomware Response Playbook Is Likely Missing Becky Bracken, Editor, Dark Reading Samsung Engineers Feed Sensitive Data to ChatGPT, Sparking Workplace AI Warnings Jai Vijayan, Contributing Writer, Dark Reading LastPass Breach Reveals Important Lessons Mike Walters, VP of Vulnerability and Threat Research & Co-Founder, Action1 Corporation FIN7, Former Conti Gang Members Collaborate on 'Domino' Malware Jai Vijayan, Contributing Writer, Dark Reading Webinars * Unleashing AI to Assess Cybersecurity Risk * Puzzled by Patching: Solve Endpoint Pains * Building the SOC of the Future: Next-Gen Security Operations * Everything you Need to Know about DNS Attacks * Why Threat Modeling Is Critical for Enterprise Cyber Defense More Webinars Reports * Successfully Managing Identity in Modern Cloud and Hybrid Environments * The 10 Most Impactful Types of Vulnerabilities for Enterprises Today * Shoring Up the Software Supply Chain Across Enterprise Applications * The Promise and Reality of Cloud Security * 10 Hot Talks From Black Hat USA 2022 More Reports White Papers * ESG Report: Automated Application Security Testing for Faster Development * Top 5 Reasons to Prioritize Privileged Access Management * The Big Business Of Cybercrime: A Deep Dive Guide * 2023 Gartner Market Guide for Cloud-Native Application Protection Platforms (CNAPP) * 2023 Cloud Threat Report More White Papers Events * Anatomy of a Data Breach - A Dark Reading June 22 Event * Black Hat USA - August 5-10 - Learn More More Events More Insights White Papers * ESG Report: Automated Application Security Testing for Faster Development * Top 5 Reasons to Prioritize Privileged Access Management More White Papers Webinars * Unleashing AI to Assess Cybersecurity Risk * Puzzled by Patching: Solve Endpoint Pains More Webinars Reports * Successfully Managing Identity in Modern Cloud and Hybrid Environments * The 10 Most Impactful Types of Vulnerabilities for Enterprises Today More Reports DISCOVER MORE FROM INFORMA TECH * Interop * InformationWeek * Network Computing * ITPro Today * Data Center Knowledge * Black Hat * Omdia WORKING WITH US * About Us * Advertise * Reprints FOLLOW DARK READING ON SOCIAL * * * * * * * Home * Cookies * Privacy * Terms Copyright © 2023 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG. Cookies Button ABOUT COOKIES ON THIS SITE We and our partners use cookies to enhance your website experience, learn how our site is used, offer personalised features, measure the effectiveness of our services, and tailor content and ads to your interests while you navigate on the web or interact with us across devices. You can choose to accept all of these cookies or only essential cookies. To learn more or manage your preferences, click “Settings”. For further information about the data we collect from you, please see our Privacy Policy Accept All Settings COOKIE PREFERENCE CENTER When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information Allow All MANAGE CONSENT PREFERENCES STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button BACK Search Icon Filter Icon Clear checkbox label label Apply Cancel Consent Leg.Interest checkbox label label checkbox label label checkbox label label * View Cookies * Name cookie name Confirm My Choices