Flash Notice: Microsoft Patch Tuesday Addresses 11 Critical Vulnerabilities & 1 Zero-Day

overview

Microsoft recently released its Patch Tuesday fixes which included a patch for an actively exploited zero-day vulnerability, CVE-2023-21674. This CVE exploits a browser sandbox escape exposure that could lead to system privilege escalation. With a base score of 8.8, Avast researchers Jan Vojtěšek, Milánek, and Przemek Gmerek explain:

“We observed an active exploitation of the vulnerability, and also can say that the vulnerability is likely part of a longer infection chain through browser, because for the CVE-2023-21674 exploit to work, the attackers already had to somehow obtain the ability to run arbitrary native code inside a sandboxed renderer process. This is something that is normally not possible against a fully patched browser unless the attackers possess a separate renderer 0-day exploit. However, we do not have the full chain. (bleepingcomputer.com)" 

This CVE is being actively exploited, is recommended to patch immediately.

The patch addresses:

• 39 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 33 Remote Code Execution Vulnerabilities
• 10 Information Disclosure Vulnerabilities
• 10 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

Impacted systems:

How Avertium is Protecting Our CUSTOMERS

• Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so, you’ll have no more blind spots, weak links, or fire drills. 
• Avertium recommends utilizing our service for DFIR (Digital Forensics and Incident Response) to help you rapidly assess, contain, eradicate, and recover from a security incident like a malware attack. 
• Fusion MXDR is the first MDR offering that fuses together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts. 
• Avertium offers VMaaS to provide a deeper understanding and control over organizational information security risks.  If your enterprise is facing challenges with the scope, resources, or skills required to implement a vulnerability management program with your team, outsourced solutions can help you bridge the gap.