January's Patch Tuesday Rings in the New Year with Nearly 100 Vulnerabilities

After a light December, IT and security teams have their work cut out for them as we enter 2023 with nearly 100 vulnerabilities patched by Microsoft in the first Patch Tuesday of the new year. Of the 98 vulnerabilities, 11 are critical, and 1 is being actively exploited. 

IT and security teams should prioritize CVE-2023-21674, an important and actively exploited zero-day vulnerability in Windows Advanced Local Procedure Call (ALPC) that allows for elevation to full system privileges when exploited. SharePoint Server admins will also want to quickly fix a critical security feature bypass that allows an unauthenticated attacker to connect to vulnerable SharePoint servers anonymously. Though there’s no evidence of exploitation yet, Microsoft notes this vulnerability is likely to be targeted. 

CVE-2023-21552 and CVE-2023-21532 are also vulnerabilities that administrators should remediate quickly, both of which are important and more likely to be exploited. The vulnerabilities allow for elevation to SYSTEM privileges due to a weakness in Windows GDI. Most versions of Windows 10, 11, and Server 2008-2022 are vulnerable so we expect nearly all organizations using Windows to be impacted.

There’s also an important and publicly disclosed elevation of privilege vulnerability in the Windows Workstation Service. Though CVE-2023-21549 is publicly disclosed, it’s less likely to be exploited as only Windows installations with less than 3.5 GB of RAM or versions older than Windows 10 version 1703 are vulnerable. 

And finally, if you still use Windows 7 Pro or Enterprise (along with 8.1), Extended Security Updates (ESU) end today. We’d strongly recommend decommissioning these operating systems if you haven’t already as they’ll no longer see critical and important vulnerabilities patched by Microsoft moving forward. Bleeping Computer notes that nearly 11% of all Windows systems worldwide still run Windows 7. 

CVE-2023-21674 - Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability - IMPORTANT

2023 has kicked-off with another Windows Advanced Local Procedure Call (ALPC) elevation vulnerability, CVE-2023-21674, from Microsoft. With a local attack vector, with both low attack complexity and low privileges required, this APLC vulnerability requires no user interaction to be exploited. This elevation of privilege vulnerability exists when Windows improperly handles calls to ALPC which enables the elevation of an attacker's privileges from sandboxed execution inside Chromium to kernel execution and full system privileges. 

To exploit this vulnerability, an attacker would first have to log on to the system, run a specially crafted application, and then take control of the affected system. A successful attacker could then run arbitrary code in the security context of the local system and install programs enabling them to view, change, or delete data, or, worse case, create new accounts with full user rights.

With an official fix for the zero-day released from Microsoft for Windows 11, Windows 10, and Windows 8.1 as well as Windows Server 2022, 2019, 2016, and 2012 R2, Automox recommends patching within 24 hours. - Gina Geisel

CVE-2023-21743 - Microsoft SharePoint Server Security Feature Bypass Vulnerability - CRITICAL

CVE-2023-21743 is a critical vulnerability which affects Microsoft Sharepoint Server. The attacker can bypass the protection in SharePoint, blocking the HTTP request based on the IP range. If an attacker successfully exploits this vulnerability, they can validate the presence or absence of an HTTP endpoint within the blocked IP range. Additionally, the vulnerability requires the attacker to have read access to the target Sharepoint site.

Automox recommends patching this vulnerability within 72 hours to minimize exposure to unnecessary cyber risk. - Preetham Gurram

CVE-2023-21549 -Windows Workstation Service Elevation of Privilege Vulnerability - IMPORTANT

CVE-2023-21549 is an important CVSSv3.1 8.8/10 elevation of privilege vulnerability in the Windows Workstation Service. The vulnerability affects most versions of Windows 7, 8.1, 10, 11 and Server 2012-2022. The vulnerability has been publicly disclosed, though it is less likely to be exploited. 

Windows installations with less than 3.5 GB of memory or versions older than Windows 10 1703 are vulnerable to attack. If you have machines in your environment that fit the bill, we recommend patching within 72 hours as an attacker could execute remote procedure call (RPC) functions restricted to local clients. - Peter Pflaster    

CVE-2023-21552 and CVE-2023-21532 - Windows GDI Elevation of Privilege Vulnerabilities - IMPORTANT

Elevation of privilege, also referred to as privilege escalation, is a vulnerability that allows an adversary to gain unauthorized access by elevating the access and execution permissions to carry out attacks on the system. At the same time, this vulnerability does not allow for remote code execution and requires the attacker to have device access and user permissions to execute code on the target system.

The vulnerability affects the Graphics Device Interface (GDI). GDI is the original graphics interface for the Windows operating system. Patching can mitigate the vulnerability. Automox recommends patching this vulnerability within 72 hours to minimize exposure to unnecessary cyber risks. - Preetham Gurram