Security Advisory 2023-064

History:

• 13/09/2023 --- v1.0 -- Initial publication

Summary

Microsoft has released its September 2023 Patch Tuesday Security Updates, addressing a total of 59 CVEs, including two actively exploited zero-day vulnerabilities [1].

Technical Details

This month's patches fix two zero-day vulnerabilities that are known to be actively exploited in the wild and one of them publicly disclosed. These zero-day vulnerabilities are:

• CVE-2023-36802 - Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability [2];

Microsoft has fixed an actively exploited local privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

• CVE-2023-36761 - Microsoft Word Information Disclosure Vulnerability [3];

Microsoft has fixed an actively exploited vulnerability that can be used to steal NTLM hashes when opening a document, including the Preview Pane. An attacker could exploit this vulnerability to allow the disclosure of NTLM hashes, which could be used in an NTLM relay-style attack.

Affected Products

Here is the full list with Microsoft's affected products and their respective vulnerabilities in the September 2023 Patch Tuesday updates:

Recommendations

Microsoft urges users to apply the security updates as soon as possible to protect their systems against potential exploitation. Users should review the detailed Microsoft advisory for each vulnerability and follow the steps provided to mitigate the risks associated with these vulnerabilities.

References

[1] https://msrc.microsoft.com/update-guide/releaseNote/2023-Sep

[2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802

[3] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761