This month we got patches for 114 vulnerabilities. Of these, 7 are critical, and 1 is already being exploited, according to Microsoft.

The exploited vulnerability is an Elevation of Privilege affecting the Windows Common Log File System Driver (CVE-2023-28252). The advisory says that the vulnerability severity is important, the attack vector is local, and the attack complexity is low. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. As this vulnerability is being exploited, it is recommended that you apply the patch as soon as possible. The CVSS for this vulnerability is 7.8.

Among critical vulnerabilities, there is a Remote Code Execution (RCE) affecting Microsoft Message Queuing (MSMQ) (CVE-2023-21554). MSMQ technology enables applications running at different times to communicate across heterogeneous networks and systems that may be temporarily offline. To exploit this vulnerability, an attacker must send a specially crafted malicious MSMQ packet to an MSMQ server. This could result in remote code execution on the server side. The MSMQ service, which is a Windows component, needs to be enabled for a system to be exploitable by this vulnerability. You can check to see if there is a service running named Message Queuing, and TCP port 1801 is listening on the machine. The CVSS for this vulnerability is 9.8.

There is also an RCE affecting DHCP Server Service (CVE-2023-28231). According to the advisory, an authenticated attacker could exploit this vulnerability by leveraging a specially crafted RPC call to the DHCP service. Successful exploitation of this vulnerability requires that an attacker first gain access to the restricted network before running an attack. The CVSS for this vulnerability is 8.8.

See my dashboard for a more detailed breakout: https://patchtuesdaydashboard.com/. 

April 2023 Security Updates

--
Renato Marinho
Morphus Labs| LinkedIn|Twitter