The CVSS for this vulnerability is 8.1, but Microsoft says exploiting the flaw may be tricky and unreliable for attackers.Īnother vulnerability patched this month that was disclosed publicly before today (but not yet seen exploited in the wild) is CVE-2023-29325, a weakness in Microsoft Outlook and Explorer that can be exploited by attackers to remotely install malware. Meanwhile, CVE-2023-28283 is a critical bug in the Windows Lightweight Directory Access Protocol (LDAP) that allows an unauthenticated attacker to execute malicious code on the vulnerable device. The CVSS for this vulnerability is 9.8 – the highest of all the flaws addressed this month. Microsoft’s advisory also includes mitigation advice. In addition to the two zero-days fixed this month, Microsoft also patched five remote code execution (RCE) flaws in Windows, two of which have notably high CVSS scores.ĬVE-2023-24941 affects the Windows Network File System, and can be exploited over the network by making an unauthenticated, specially crafted request. Defenders ignore this vulnerability at their peril.” ![]() Rapid7 has noted in the past that enabling Secure Boot is a foundational protection against driver-based attacks. The attack surface is not limited to physical assets, either Windows assets running on some VMs, including Azure assets with Secure Boot enabled, also require these extra remediation steps for protection. “The patch enables the configuration options necessary for protection, but administrators must apply changes to UEFI config after patching. “Administrators should be aware that additional actions are required beyond simply applying the patches,” Barnett advised. “Therefore, the relatively low CVSSv3 base score of 6.7 isn’t necessarily a reliable metric in this case.”īarnett said Microsoft has provided a supplementary guidance article specifically calling out the threat posed by BlackLotus malware, which loads ahead of the operating system on compromised assets, and provides attackers with an array of powerful evasion, persistence, and Command & Control (C2) techniques, including deploying malicious kernel drivers, and disabling Microsoft Defender or Bitlocker. ![]() “Microsoft warns that an attacker who already has Administrator access to an unpatched asset could exploit CVE-2023-24932 without necessarily having physical access,” Barnett said. Microsoft gives this flaw a CVSS score of just 6.7, rating it as “Important.”Īdam Barnett, lead software engineer at Rapid7, said CVE-2023-24932 deserves a considerably higher threat score. The zero-day patch that has received the most attention so far is CVE-2023-24932, which is a Secure Boot Security Feature Bypass flaw that is being actively exploited by “bootkit” malware known as “ BlackLotus.” A bootkit is dangerous because it allows the attacker to load malicious software before the operating system even starts up.Īccording to Microsoft’s advisory, an attacker would need physical access or administrative rights to a target device, and could then install an affected boot policy. This can allow the attacker to disable security tooling and deploy more attacker tools like Mimikatz that lets them move across the network and gain persistence.” “Once they gain initial access they will seek administrative or SYSTEM-level permissions. “Local Privilege escalation vulnerabilities are a key part of attackers’ objectives,” said Kevin Breen, director of cyber threat research at Immersive Labs. However, as the SANS Internet Storm Center points out, the attack vector for this bug is local. ![]() Microsoft today released software updates to fix at least four dozen security holes in its Windows operating systems and other software, including patches for two zero-day vulnerabilities that are already being exploited in active attacks.įirst up in May’s zero-day flaws is CVE-2023-29336, which is an “elevation of privilege” weakness in Windows which has a low attack complexity, requires low privileges, and no user interaction.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |