A November rain of patches from Microsoft

Microsoft on Tuesday released patches for 57 vulnerabilities, including 31 for Windows. Eleven other product groups are also affected. Of the 57 CVEs addressed, just 3 are considered Critical in severity; 2 of those are in Windows, while the third falls in Azure. One CVE, an Important-severity elevation-of-privilege issue (CVE-2023-36049), affects both .NET and Visual Studio; another Important-severity EoP affects .NET, Visual Studio, and also ASP.NET.

At press time, three Windows issues are known to be under exploit in the wild. (Or, depending on how you count these things, there are four, as we’ll discuss in the Notable November Updates section below.) An additional 10 vulnerabilities in Windows, Exchange, Office, and SharePoint are by the company’s estimation more likely to be exploited in the next 30 days, with the Office vulnerability (CVE-2023-36413, a security feature bypass) publicly disclosed already.

In addition to the 57 CVEs, Microsoft lists one official advisory, ADV990001, which covers their latest servicing stack updates. However, the list of information-only advisories is extensive this month. In addition to 21 CVEs affecting Edge/Chromium (six of those Edge-specific), there is information on an industry-wide issue affecting BlueTooth; an HTTP/2-related issue, currently under active exploit in the wild, touching Windows, ASP.NET, .NET and Visual Studio; five CBL-Mariner-related issued covered by CVEs from Kubernetes, Red Hat, and MITRE; 17 Adobe-issued patches for Acrobat Reader, and seven more patches from Adobe for ColdFusion.

We don’t include these 53 issues in the CVE counts and graphics below, but we’ll provide information on everything in an appendix at the end of the article. We are as usual including at the end of this post three appendices listing all Microsoft’s patches, sorted by severity, by predicted exploitability, and by product family.

In addition to all of this, Windows Server 2022, 23H2 Edition (Server Core installation) is released as part of this update.

By the numbers

• Total Microsoft CVEs: 57
• Total Microsoft advisories shipping in update: 1
• Total other advisory issues covered in update: 52
• Publicly disclosed: 3
• Exploited: 3 plus one in non-Microsoft advisory issue
• Severity
  • Critical: 3
  • Important: 54
• Impact
  • Elevation of Privilege: 17
  • Remote Code Execution: 16
  • Spoofing: 9
  • Information Disclosure: 6
  • Security Feature Bypass: 5
  • Denial of Service: 4

Figure 1: This month elevation of privilege issues were slightly more prevalent than remote code execution for a change; spoofing also makes a strong showing

Products

• Windows: 31
• Dynamics 365: 5
• Exchange: 4
• Office: 4
• Visual Studio: 4, including one shared with .NET and one shared with ASP.NET and .NET
• ASP.NET: 3, including one shared with .NET and Visual Studio
• Azure: 3
• .NET: 2 (one shared with Visual Studio and one shared with ASP.NET and Visual Studio)
• Defender: 1
• Host Integration Server: 1
• On-Premises Data Gateway: 1
• SharePoint: 1

Figure 2: Windows as usual takes the lion’s share of patches in November, but there’s a fairly wide variety of more specialized products affected. (In the case of patches touching more than one product, each instance is represented in this chart; for instance, CVE-2023-36049, which affects both Visual Studio and .NET, is counted once for each of the two)

Notable November updates

In addition to the issues discussed above, a few interesting items present themselves.

CVE-2023-36025 — Windows SmartScreen Security Feature Bypass Vulnerability

There are three Windows CVEs this month for which active exploitation has been detected in the wild. (Or four; more on that in a minute.) This one, an Important-class security feature bypass, has the highest CVSS base and temporal scores (Base 8.8 / Temporal 8.2) of the trio. All it takes is a malicious URL, and the attacker is able to bypass Windows Defender SmartScreen checks and the prompts the user would expect to see with those.

CVE-2023-36397 — Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

Is message queuing enabled on your system? This vulnerability, which can be triggered by an attacker sending a maliciously crafted file over the network, is critical-severity (CVSS 3.1 9.8/8.5) and can lead to RCE. In addition to the other protections released for this, Microsoft notes that users can check their exposure by checking to see if the service called Message Queuing is running, and if TCP port 1801 is in listening mode.

CVE-2020-8554, CVE-2023-46753, CVE-2023-46316, CVE-2020-14343, CVE-2020-1747 (5 CVEs)

These five CVEs are not part of Microsoft’s official release, but no one using Microsoft’s CBL-Mariner (Common Base Linux Mariner) should sleep on them. CBL-Mariner is Microsoft’s own Linux distro; first developed in-house for internal development and Azure management. The distro was quietly made publicly available to the public last year. None of the three CVEs are directly from Microsoft, but from Kubernetes (CVE-2020-8554), Red Hat (CVE-2020-14343, CVE-2020-1747), and MITRE (CVE-2023-46316, CVE-2023-46753). Due to the apparent age of several of these CVEs and their severity – three of the five have a CVSS base score of 9.8 out of 10 – users are encouraged to keep themselves up to date.

CVE-2023-24023 — MITRE: CVE-2023-24023 Bluetooth Spoofing Vulnerability
CVE-2023-44487 — MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack

Speaking of MITRE, the organization features in two more CVEs about which Microsoft is publishing information. As one would expect, the MITRE CVEs are applicable for many companies, not only Microsoft. CVE-2023-24023 covers an important-severity spoofing vulnerability reported to BlueTooth’s governing body. As for CVE-2023-44487, this CVE makes an unusual repeat appearance on the Patch Tuesday roster; readers may remember that we discussed this Rapid Reset issue in last month’s roundup. It affects Windows, ASP.NET, .NET, and Visual Studio.

Figure 3: With one month to go in 2023, the tally of remote code execution patches releases reaches 300. Meanwhile, it’s barely visible, but the year’s first critical-level information-disclosure issue shows on the chart

Sophos protections

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Windows Update Catalog website. Run the winver.exe tool to determine which build of Windows 10 or 11 you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of November’s patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE.

Elevation of Privilege (17 CVEs)

Remote Code Execution (16 CVEs)

Spoofing (9 CVEs)

Information Disclosure (6 CVEs)

Security Feature Bypass (5 CVEs)

Denial of Service (4 CVE)

Appendix B: Exploitability

This is a list of the November CVEs judged by Microsoft to be more likely to be exploited in the wild within the first 30 days post-release, as well as those already known to be under exploit. Each list is further arranged by CVE.

Appendix C: Products Affected

This is a list of November’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family.

Windows (29 CVEs)

Dynamics 365 (5 CVEs)

Exchange (4 CVEs)

Office (4 CVEs)

Visual Studio (4 CVEs)

ASP.NET (3 CVEs)

Azure (3 CVEs)

.NET (2 CVEs)

Defender (1 CVE)

Host Integration Server (1 CVE)

On-Premises Data Gateway (1 CVE)

SharePoint (1 CVE)

Appendix D: Other Products

This is a list of advisories and information on other relevant CVEs in the November Microsoft release, sorted by product.

Microsoft Servicing Stack Updates

Adobe Acrobat Reader Bulletin APSB23-54: Security updates available for Acrobat Reader (17 CVEs)

Adobe ColdFusion Bulletin APSB23-52: Security updates available for Adobe ColdFusion (7 CVEs)

Relevant MITRE releases (2 CVEs)

Relevant to CBL-Mariner (5 CVEs)

Relevant to Edge / Chromium (21 CVEs)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts