The May 2023 Security Update Review

It’s patch Tuesday once again, and Adobe and Microsoft have released their monthly batch of security updates. Take a break from your regularly scheduled activities and join us as we review the details of the latest offerings from Microsoft and Adobe. If you’d rather watch the video recap, you can check out the Patch Report webcast on our addressing 11 Critical-rated and 3 Important-rated vulnerabilities. All of these bugs were found and reported by ZDI vulnerability researcher Mat Powell. The most severe of these issues would allow an attacker to execute arbitrary code on an affected system if they can convince a user to open a specially-crafted file.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Adobe categorizes these updates as a deployment priority rating of 3.

Microsoft Patches for May 2023

This month, Microsoft released 38 new patches addressing CVEs in Microsoft Windows and Windows Components; Office and Office Components; Microsoft Edge (Chromium-based); SharePoint Server; Visual Studio; SysInternals; and Microsoft Teams. This is in addition to 11 CVEs in Chromium that were previously released for Edge and are now being documented in the Security Updates Guide.

A total of four of these bugs came were submitted through the ZDI program. This includes three SharePoint fixes that were reported during the most recent Pwn2Own Vancouver competition. However, none of the other bugs reported at that event have yet to be addressed by Microsoft.

Of the new patches released today, seven are rated Critical and 31 are rated Important in severity. May tends to be a smaller month for fixes historically, but this month’s volume is the lowest since August 2021. However, considering just the number of ZDI cases waiting to be patched, this number is expected to rise in the coming months.

One of the new CVEs is listed as under active attack and two are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the one bug under active attack:

-       – Windows OLE Remote Code Execution Vulnerability
While the title says OLE, when it comes to this bug, the real component to worry about is Outlook. This vulnerability allows an attacker to execute their code on an affected system by sending a specially crafted RTF e-mail. The Preview Pane is an attack vector, so a target doesn’t even need to read the crafted message. And while Outlook is the more likely exploit vector, other Office applications are also impacted. This is one of the publicly known bugs patched this month and has been widely discussed on Twitter. Although Microsoft offers some workarounds, it’s a better idea to test and deploy this update quickly.

-        patch from May 2022 installed. The better idea is to test and deploy this month’s fix instead.

-      
Win32k Elevation of Privilege
Vulnerability
Important
7.8
No
Yes
EoP

Secure Boot Security Feature Bypass
Vulnerability
Important
6.7
Yes
No
SFB

Windows Lightweight Directory Access
Protocol (LDAP) Remote Code Execution Vulnerability
Critical
8.1
No
No
RCE

Windows Network File System Remote Code
Execution Vulnerability
Critical
9.8
No
No
RCE

Windows Secure Socket Tunneling Protocol
(SSTP) Remote Code Execution Vulnerability
Critical
8.1
No
No
RCE

AV1 Video Extension Remote Code Execution
Vulnerability
Important
7.8
No
No
RCE

Microsoft Edge (Chromium-based) Elevation of
Privilege Vulnerability
Important
7.5
No
No
EoP

Microsoft Office Remote Code Execution
Vulnerability
Important
7.8
No
No
RCE

Microsoft SharePoint Server Spoofing
Vulnerability
Important
6.5
No
No
Spoofing

Microsoft Word Security Feature Bypass
Vulnerability
Important
7.5
No
No
SFB

Remote Desktop Protocol Client Information
Disclosure Vulnerability
Important
5.5
No
No
Info

Server for NFS Denial of Service
Vulnerability
Important
7.5
No
No
DoS

Visual Studio Code Information Disclosure
Vulnerability
Important
5
No
No
Info

Windows Backup Service Elevation of
Privilege Vulnerability
Important
7.8
No
No
EoP

Windows Bluetooth Driver Information
Disclosure Vulnerability
Important
6.5
No
No
Info

Windows Driver Revocation List Security
Feature Bypass Vulnerability
Important
5.5
No
No
SFB

Windows Installer Elevation of Privilege
Vulnerability
Important
7.1
No
No
EoP

Windows Kernel Elevation of Privilege
Vulnerability
Important
7.8
No
No
EoP

Windows NTLM Security Support Provider
Information Disclosure Vulnerability
Important
5.9
No
No
Info

Windows SMB Denial of Service
Vulnerability
Important
7.5
No
No
DoS

Chromium: CVE-2023-2459 Inappropriate
implementation in Prompts
Medium
N/A
No
No
RCE

Chromium: CVE-2023-2462 Inappropriate
implementation in Prompts
Medium
N/A
No
No
RCE

Chromium: CVE-2023-2464 Inappropriate
implementation in PictureInPicture
Medium
N/A
No
No
RCE

Chromium: CVE-2023-2466 Inappropriate
implementation in Prompts
Low
N/A
No
No
RCE

Chromium: CVE-2023-2468 Inappropriate
implementation in PictureInPicture
Low
N/A
No
No
RCE

* Indicates this CVE had been released prior to today.

Looking at the remaining Critical-rated patches, there’s another CVSS 9.8 bug in Pragmatic General Multicast (PGM) that looks identical to PGM bug patched last month. This could indicate a failed patch or, more likely, a wide attack surface in PGM that is just starting to be explored. There are patches for Critical-rated bugs in the LDAP and SSTP protocols. Finally, there’s an intriguing bug in MSHTML that could allow a remote attacker to escalate to administrator privileges. Microsoft doesn’t provide details here, but they do note some level of privileges are required. As written, it reads as though an authenticated user could browse to a site and gain administrative rights. 

Moving on to the other code execution bugs fixed this month, there are the standard open-and-own bugs in Office products. There are a couple of fixes for the AV1 Video Extensions, which are not installed by default. These updates are available from the Windows Store, so if you’re in a disconnected environment, you’ll need to manually apply these fixes. The code execution bug in RDP is somewhat troubling, but it’s client not server, so that lessens the severity a bit. The bug in Bluetooth requires the attacker to be in close physical proximity. The final RCE patch for May fixes a bug in the NuGet package manager client. Microsoft provides no details on the attack scenario, but it’s likely a client would need to connect to a specially crafted .NET project to be exploited.

In addition to the two already mentioned, there are eight other elevation of privilege (EoP) bugs being fixed this month. Most of these require an authenticated user to run specially crafted code, resulting in code execution at the level of SYSTEM. Like the Bluetooth RCE, the EoP in Bluetooth requires close proximity. The bug in Windows Installer only allows an attacker to delete targeted files rather than escalate to SYSTEM.

There are four security feature bypass (SFB) vulnerabilities being patched this month, including a publicly known bypass of the Secure Boot feature. As is typical, Microsoft does not provide information on where this vulnerability is public, however, they do provide some additional information about some additional , which is a rather interesting VPN-like functionality for SMB. Apart from the DoS in Access, it’s unclear if any of these bugs blue screen the system or merely interrupt service operations. The bug in Access impacts the database connectivity but doesn’t fully deny service.

Finally, there is a spoofing bug in SharePoint receiving a patch this month. It was reported through the ZDI program by an anonymous researcher and could allow an authenticated attacker to cause the server to leak its NTLM hash. Any user on the SharePoint site has the needed permissions.

No new advisories were released this month, but there was a patch re-release of note. channel. It should be posted in just a few hours. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!