Microsoft Monthly Security Update (March 2023)
RISK: High Risk
TYPE: Operating Systems - Windows OS
Microsoft has released monthly security update for their products:
| Vulnerable Product | Risk Level | Impacts | Notes |
| Browser |  Low Risk | Spoofing | |
| Azure | Low Risk | Spoofing | |
| Windows |  High Risk | Elevation of Privilege Remote Code Execution Information Disclosure Denial of Service Security Restriction Bypass | is being exploited in the wild. The vulnerabliity can be exploited by using malicious MSI files signed with a specially crafted Authenticode signature to trigger security restriction bypass in SmartScreen and prevent Mark-of-the-Web (MotW) security alerts. |
| Extended Security Updates (ESU) |  Medium Risk | Elevation of Privilege Information Disclosure Remote Code Execution Denial of Service | |
| System Center | Medium Risk | Elevation of Privilege | |
| Microsoft Office | High Risk | Spoofing Denial of Service Elevation of Privilege Remote Code Execution Information Disclosure | is being exploited in the wild. The vulnerability can be exploited by sending malicious Outlook notes and tasks to steal NTLM hashes via NTLM negotiation requests by forcing the targets’ devices to authenticate to attacker-controlled SMB shares. |
| Microsoft Dynamics | Medium Risk | Spoofing Information Disclosure | |
| Developer Tools | Medium Risk | Information Disclosure Remote Code Execution Elevation of Privilege | |
| Apps | Medium Risk | Security Restriction Bypass |
Number of 'Extremely High Risk' product(s): 0
Number of 'High Risk' product(s): 2
Number of 'Medium Risk' product(s): 5
Number of 'Low Risk' product(s): 2
Evaluation of overall 'Risk Level': High Risk
Impact
- Denial of Service
- Elevation of Privilege
- Information Disclosure
- Remote Code Execution
- Spoofing
- Security Restriction Bypass
System / Technologies affected
- Browser
- Azure
- Windows
- Extended Security Updates (ESU)
- System Center
- Microsoft Office
- Microsoft Dynamics
- Developer Tools
- Apps
Solutions
Before installation of the software, please visit the vendor web-site for more details.
- Apply fixes issued by the vendor.
Workaround for CVE-2023-23397 vulnerability:
Reduce the vulnerability of attacks by following workaround:
- Add users to the Protected Users Security Group, which prevents the use of NTLM as an authentication mechanism
- Block TCP 445/SMB outbound from the network by using a perimeter firewall, a local firewall, and via VPN settings
Vulnerability Identifier
Source
Related Link
Related Tags
Share with