Black Arrow Cyber Advisory 15 November 2023 – Microsoft Patch Tuesday fixes five zero days, three actively exploited; Adobe, FortiGuard, VMware and WordPress Updates Summary
Executive summary
Microsoft’s November Patch Tuesday provides updates to address 58 security issues across its product range, including three actively exploited zero-day vulnerabilities. The exploited zero-day vulnerabilities include two privilege escalation vulnerabilities and a security bypass. These have been added the US Cybersecurity and Infrastructure Security Agency’s (CISA) “Known Exploited Vulnerabilities Catalog”. Also among the updates provided by Microsoft were 3 critical vulnerabilities.
In addition to the Microsoft updates this week Adobe, FortiGuard, VMware and WordPress also provided updates for vulnerabilities in their products. An addressed vulnerability in Citrix known as Citrix Bleed continues to remain a threat, with ransomware gang LockBit actively exploiting publicly known exploits for unpatched versions.
What’s the risk to me or my business?
The actively exploited vulnerability could allow an attacker with access, to bypass security, gain SYSTEM privileges and compromise the confidentiality, integrity and availability of data stored by an organisation.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating.
Technical Summary
CVE-2023-36036: An actively exploited elevation of privilege vulnerability in Windows Cloud Files Mini Filter.
CVE-2023-36033: An actively exploited elevation of privilege vulnerability in Windows DWM Core Library that could allow an attacker to gain the highest privileges.
CVE-2023-36025: An actively exploited vulnerability in Windows SmartScreen which allows a malicious internet shortcut to bypass security.
CVE-2023-36413: A Microsoft Office security feature bypass.
CVE-2023-36038: A denial of service vulnerability in ASP.NET Core.
Adobe
This month, Adobe released fixes for 25 vulnerabilities, of which 13 were rated critical, across Adobe Acrobat and Reader (17), ColdFusion (6), InCopy (1), and Dimension(1). At current, Adobe is not aware of any of these vulnerabilities being actively exploited. The vulnerabilities include remote code execution, memory leak, privilege escalation and security bypass.
Citrix
The LockBit ransomware group are using the publicly available exploits for the Citrix bleed Vulnerability. There are currently thousands of publicly available endpoints which are running and still vulnerable.
FortiGuard
This month, Fortiguard released three advisories for vulnerabilities, including one critical vulnerability, impacting FortiOS, FortiProxy-DOS and FortiProxyVM.
VMware
VMware has patched one critical authentication bypass vulnerability, tracked as CVE-2023-34060 which impacts Cloud Director Appliances. There are no available workarounds.
WordPress
A WordPress plugin, WP Fastest Cache, is vulnerable to an SQL injection vulnerability tracked as CVE-2023-6063, which could allow unauthenticated attackers to read the contents of the site’s database. At current, more than 600,000 websites run a vulnerable version of WP Fastest Cache. A software patch has been made available by the developer.
Further details on other specific updates within this month’s Microsoft Patch Tuesday can be found here: https://www.ghacks.net/2023/04/11/microsoft-windows-security-updates-april-2023-what-you-need-to-know-before-installation/
Adobe
Further details of the vulnerabilities addressed in Adobe Acrobat and Reader can be found here: https://helpx.adobe.com/security/products/acrobat/apsb23-54.html
Further details of the vulnerabilities addressed in Adobe ColdFusion can be found here:
https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
Further details of the vulnerabilities addressed in Adobe Dimension can be found here: https://helpx.adobe.com/security/products/dimension/apsb23-62.html
Further details of the vulnerabilities addressed in Adobe InCopy can be found here: https://helpx.adobe.com/security/products/incopy/apsb23-60.html
Citrix
Further details about the Citrix Bleed vulnerability can be found here:
https://www.blackarrowcyber.com/blog/advisory-26-october-2023-citrix-bleed-vulnerability
FortiGuard
Further details on the FortiGuard advisories can be found here:
https://www.fortiguard.com/psirt
VMware
Further information of the vulnerability address by VMware can be found here: https://www.vmware.com/security/advisories/VMSA-2023-0026.html
WordPress
Further information on the WordPress vulnerability can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity