Critical Patches Issued for Microsoft Products January 10, 2023

This Multi-State Information Sharing and Analysis Center (MS-ISAC) Advisory is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals.

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Threat Intelligence

Two zero-day vulnerabilities addressed in this advisory were reported by Microsoft, one of which is currently being exploited in the wild. The first zero day is CVE-2023-21674 - Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability which is a Sandbox escape vulnerability that can lead to the elevation of privileges, and is currently being exploited in the wild. The second zero day is CVE-2023-21549 - Windows SMB Witness Service Elevation of Privilege Vulnerability and if exploited the attacker could execute RPC functions that are restricted to privileged accounts only.

System Affected

• NET Core
• 3D Builder
• Azure Service Fabric Container
• Microsoft Bluetooth Driver
• Microsoft Exchange Server
• Microsoft Graphics Component
• Microsoft Local Security Authority Server (lsasrv)
• Microsoft Message Queuing
• Microsoft Office
• Microsoft Office SharePoint
• Microsoft Office Visio
• Microsoft WDAC OLE DB provider for SQL
• Visual Studio Code
• Windows ALPC
• Windows Ancillary Function Driver for WinSock
• Windows Authentication Methods
• Windows Backup Engine
• Windows Bind Filter Driver
• Windows BitLocker
• Windows Boot Manager
• Windows Credential Manager
• Windows Cryptographic Services
• Windows DWM Core Library
• Windows Error Reporting
• Windows Event Tracing
• Windows IKE Extension
• Windows Installer
• Windows Internet Key Exchange (IKE) Protocol
• Windows iSCSI
• Windows Kernel
• Windows Layer 2 Tunneling Protocol
• Windows LDAP - Lightweight Directory Access Protocol
• Windows Local Security Authority (LSA)
• Windows Local Session Manager (LSM)
• Windows Malicious Software Removal Tool
• Windows Management Instrumentation
• Windows MSCryptDImportKey
• Windows NTLM
• Windows ODBC Driver
• Windows Overlay Filter
• Windows Point-to-Point Tunneling Protocol
• Windows Print Spooler Components
• Windows Remote Access Service L2TP Driver
• Windows RPC API
• Windows Secure Socket Tunneling Protocol (SSTP)
• Windows Smart Card
• Windows Task Scheduler
• Windows Virtual Registry Provider
• Windows Workstation Service

Risk

Government:

• Large and medium government entities: High
• Small government entities: Medium

Businesses:

• Large and medium business entities: High
• Small business entities: Medium

Home Users: Low

Technical Summary

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution.

A full list of all vulnerabilities can be found at: https://msrc.microsoft.com/update-guide.

Recommendations

• Apply appropriate patches or appropriate mitigations provided by Microsoft to vulnerable systems immediately after appropriate testing.
• Apply the Principle of Least Privilege to all systems and services, and run all software as a non-privileged user (one without administrative rights) to diminish the effects of a successful attack.
• Remind all users not to visit untrusted websites or follow links/open files provided by unknown or untrusted sources.
• Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.

References

Microsoft:

https://msrc.microsoft.com/update-guide/

https://msrc.microsoft.com/update-guide/releaseNote/2023-Jan

Reporting

The NJCCIC encourages recipients who discover signs of malicious cyber activity to contact the NJCCIC via the cyber incident report form at www.cyber.nj.gov/report.

Please do not hesitate to contact the NJCCIC at njccic@cyber.nj.gov with any questions.  Also, for more background on our recent cybersecurity efforts, please visit cyber.nj.gov.