Microsoft Patch Releases: Safeguarding Against Flaws

Wajahat Raja

October 26, 2023 - TuxCare expert team

Microsoft published its monthly Patch Tuesday updates in October 2023, resolving a total of 103 vulnerabilities across its platforms. In the wild, two of these issues were actively exploited. In this blog, we’ll look at the Microsoft patch releases, the key aspects of these updates, and their potential impact on hybrid environments that combine Linux and Windows systems, often relying on centralized identity management through the Active Directory.

Microsoft Patch Releases

Microsoft’s October updates encompassed a total of 103 vulnerabilities, categorized into two severity levels: Critical (13) and Important (90). Additionally, 18 security issues were addressed in the Chromium-based Edge browser. These security flaws fixes are essential to protect your system from potential threats and vulnerabilities.

Two of the vulnerabilities had been weaponized as zero-days before the release of the October 2023 Patch Tuesday updates. Let’s delve into these vulnerabilities and their potential consequences.

CVE-2023-36563 – Microsoft WordPad Information Disclosure (CVSS score: 6.5)

This vulnerability poses a risk of leaking NTLM hashes. It was exploited in the wild before its public disclosure. To exploit this flaw, an attacker would typically employ social engineering to trick a user into opening a malicious link or file. Successful exploitation could lead to the exposure of NTLM hashes.

CVE-2023-41763 – Skype for Business Privilege Escalation (CVSS score: 5.3)

This vulnerability could enable attackers to gain access to internal networks by escalating privileges in Skype for Business. It could expose sensitive information like IP addresses or port numbers. To exploit this flaw, an attacker would need to convince a local user to open a malicious file or click a link in an email or instant message.

Zero-Day Vulnerabilities in Hybrid Environments

In hybrid environments that combine Linux and Windows systems, particularly those utilizing Active Directory for centralized identity management, the risk of these zero-day vulnerabilities becomes even more pronounced. Attackers could potentially exploit these vulnerabilities to compromise linked accounts and gain unauthorized access to your network.

It’s noteworthy that CVE-2023-36563 is the third zero-day vulnerability patched in 2023, all of which could lead to unauthorized disclosure of NTLM hashes. Software exploit patching is a fundamental aspect of maintaining a secure and resilient digital environment. This trend emphasizes the importance of staying up to date with security patches and keeping your systems protected.

Other Critical Updates

Apart from these zero-day vulnerabilities, Microsoft’s October updates address several critical issues:

Microsoft Message Queuing (MSMQ) and Layer 2 Tunneling Protocol: Vulnerabilities in these components could lead to remote code execution and denial-of-service (DoS) attacks.
Windows IIS Server (CVE-2023-36434): A privilege escalation bug that could allow an attacker to impersonate and log in as another user via a brute-force attack. In a hybrid environment, this could compromise linked accounts and the entire network’s security.
CVE-2023-44487 – The HTTP/2 Rapid Reset Attack: Exploited by unknown actors as a zero-day to stage distributed denial-of-service (DDoS) attacks. While this DDoS has the potential to impact service availability, there’s no evidence of customer data compromise at this time.

The Future of VBScript

Visual Basic Script (VBScript) was likewise deprecated by Microsoft. VBScript is widely used to distribute malware. Before being removed from the operating system, it will be accessible as a feature on demand in future Windows editions. This decision emphasizes the significance of adopting more secure scripting languages and practices.

Securing Your Hybrid Environment

In a hybrid environment that combines Linux and Windows systems with centralized identity management, such as Active Directory, maintaining robust security is essential. Here are some key steps you can take to protect your organization:

Stay Informed: Regularly monitor Microsoft security updates and apply them promptly to safeguard your systems.
Security Best Practices: Follow cybersecurity best practices for Active Directory and ensure that your linked accounts are protected against potential threats.
User Education: Train your users to recognize social engineering tactics and be cautious when clicking on links or opening files, especially in emails or messages.
Brute-Force Mitigation: Implement strong password policies and measures to defend against brute-force attacks.
Scripting Transition: As VBScript is being deprecated, consider transitioning to more secure scripting languages to enhance your overall security posture.

Conclusion

Microsoft’s Patch Tuesday updates for October 2023 address a range of critical vulnerabilities, two of which were actively exploited as zero-days. Regularly applying the Windows update for vulnerabilities is crucial to keeping your system secure. In hybrid environments that incorporate both Linux and Windows systems, often utilizing Active Directory, these vulnerabilities pose a considerable risk. Protecting your computer by applying security updates, adhering to best practices, and educating users are essential steps to ensure the security and resilience of your network.

The sources for this piece include articles in The Hacker News and SC Media.

Summary