Microsoft Patch Tuesday: 36 RCE bugs, 3 zero-days, 75 CVEs

Deciphering Microsoft’s official Update Guide web pages is not for the faint-hearted.

Most of the information you need, if not everything you’d really like to know, is there, but there’s such a dizzing number of ways to view it, and so many generated-on-the-fly pages are needed to display it, that it can be tricky to find out what’s truly new, and what’s truly important.

Should you search by the operating system platforms affected?

By the severity of the vulnerabilies? By the likelihood of exploitation?

Should you sort the zero-days to the top?

(We don’t think you can – we think there are three zero-days in this month’ list, but we had to drill into individual CVE pages and search for the text “Exploitation detected” in order to be sure that a specific bug was already known to cybercriminals.)

What’s worse, an EoP or an RCE?

Is a Critical elevation of privilege (EoP) bug more alarming than an Important remote code execution (RCE)?

The former type of bug requires cybercriminals to break in first, but probably gives them a way to take over completely, typically getting them the equivalent of sysadmin powers or operating system-level control.

The second type of bug might only get the crooks in with the lowly access privileges of little old you, but it nevertheless gets them onto the network in the first place.

Of course, while everyone else might breathe a sigh of relief if an attacker wasn’t able to get access to their stuff, that’s cold comfort for you, if you’re the one who did get attacked.

We counted 75 CVE-numbered bugs dated 2023-02-14, given that this year’s February updates arrived on Valentine’s Day.

(Actually, we fond 76, but we ignored one bug that didn’t have a severity rating, was tagged CVE-2019-15126, and seems to boil down to a report about unsupported Broadcom Wi-Fi chips in Microsoft Hololens devices – if you have a Hololens and have any advice for other readers, please let us know in the comments below.)

We extracted a list and included it below, sorted so that the bugs dubbed Critical are at the top (there are seven of them, all RCE-class bugs).

You can also read the SophosLabs analysis of Patch Tuesday for more details.

Security bug classes explained

If you’re not familiar with the bug abbreviations shown below, here’s a high-speed guide to security flaws:

• RCE means Remote Code Execution. Attackers who aren’t currently logged on to your computer could trick it into running a fragment of program code, or even a full-blown program, as if they had authenticated access. Typically, on desktops or servers, the criminals use this sort of bug to implant code that allows them to get back in at will in future, thus establishing a beachhead from which to kick off a network-wide attack. On mobile devices such as phones, the crooks may use RCE bugs to leave behind spyware that will track you from then on, so they don’t need to break in over and over again to keep their evil eyes on you.
• EoP means Elevation of Privilege. As mentioned above, this means crooks can boost their access rights, typically acquiring the same sort of powers that an official sysadmin or the operating itself would usually enjoy. Once they have system-level powers, they are often able to roam freely on your network, steal secure files even from restricted-access servers, create hidden user accounts for getting back in later, or map out your entire IT estate in preparation for a ransomware attack.
• Leak means that security-related or private data might escape from secure storage. Sometimes, even apparently minor leaks, such as the location of specific operating system code in memory, which an attacker isn’t supposed to be able to predict, can give criminals the information they need to turn an probably unsuccessful attack into an almost certainly successful one.
• Bypass means that a security protection you’d usually expect to keep you safe can be skirted. Crooks typically exploit bypass vulnerabilities to trick you into trusting remote content such as email attachments, for example by finding a way to avoid the “content warnings” or to circumvent the malware detection that are supposed to keep you safe.
• Spoof means that content can be made to look more trustworthy than it really is. For example, attackers who lure you to a fake website that shows up in your browser with an official server name in the address bar (or what looks like the address bar)are much likely to trick you into handing over personal data than if they’re forced to put their fake content on a site that clearly isn’t the one you’d expect.
• DoS means Denial of Service. Bugs that allow network or server services to be knocked offline temporarily are often considered low-grade flaws, assuming that the bug doesn’t then allow attackers to break in, steal data or access anything they shouldn’t. But attackers who can reliably take down parts of your network may be able to do so over and over again in a co-ordinated way, for example by timing their DoS probes to happen every time your crashed servers restart. This can be extremely disruptive, esepcially if you are running an online business, and can also be used as a distraction to draw attention away from other illegal activities that the crooks are doing on your network at the same time.

The big bug list

The 75-strong bug list is here, with the three zero-days we know about marked with an asterisk (*):

  NIST ID          Level        Type    Component affected  ---------------  -----------  ------  ----------------------------------------  CVE-2023-21689:  (Critical)   RCE     Windows Protected EAP (PEAP) 	  CVE-2023-21690:  (Critical)   RCE     Windows Protected EAP (PEAP) 	  CVE-2023-21692:  (Critical)   RCE     Windows Protected EAP (PEAP) 	  CVE-2023-21716:  (Critical)   RCE     Microsoft Office Word 	  CVE-2023-21803:  (Critical)   RCE     Windows iSCSI 	  CVE-2023-21815:  (Critical)   RCE     Visual Studio 	  CVE-2023-23381:  (Critical)   RCE     Visual Studio 	  CVE-2023-21528:  (Important)  RCE     SQL Server 	  CVE-2023-21529:  (Important)  RCE     Microsoft Exchange Server 	  CVE-2023-21568:  (Important)  RCE     SQL Server 	  CVE-2023-21684:  (Important)  RCE     Microsoft PostScript Printer Driver 	  CVE-2023-21685:  (Important)  RCE     Microsoft WDAC OLE DB provider for SQL 	  CVE-2023-21686:  (Important)  RCE     Microsoft WDAC OLE DB provider for SQL 	  CVE-2023-21694:  (Important)  RCE     Windows Fax and Scan Service 	  CVE-2023-21695:  (Important)  RCE     Windows Protected EAP (PEAP) 	  CVE-2023-21703:  (Important)  RCE     Azure Data Box Gateway 	  CVE-2023-21704:  (Important)  RCE     SQL Server 	  CVE-2023-21705:  (Important)  RCE     SQL Server 	  CVE-2023-21706:  (Important)  RCE     Microsoft Exchange Server 	  CVE-2023-21707:  (Important)  RCE     Microsoft Exchange Server 	  CVE-2023-21710:  (Important)  RCE     Microsoft Exchange Server 	  CVE-2023-21713:  (Important)  RCE     SQL Server 	  CVE-2023-21718:  (Important)  RCE     SQL Server 	  CVE-2023-21778:  (Important)  RCE     Microsoft Dynamics 	  CVE-2023-21797:  (Important)  RCE     Windows ODBC Driver 	  CVE-2023-21798:  (Important)  RCE     Windows ODBC Driver 	  CVE-2023-21799:  (Important)  RCE     Microsoft WDAC OLE DB provider for SQL 	  CVE-2023-21801:  (Important)  RCE     Microsoft PostScript Printer Driver 	  CVE-2023-21802:  (Important)  RCE     Microsoft Windows Codecs Library 	  CVE-2023-21805:  (Important)  RCE     Windows MSHTML Platform 	  CVE-2023-21808:  (Important)  RCE     .NET and Visual Studio 	  CVE-2023-21820:  (Important)  RCE     Windows Distributed File System (DFS) 	  CVE-2023-21823:  (Important) *RCE     Microsoft Graphics Component  CVE-2023-23377:  (Important)  RCE     3D Builder 	  CVE-2023-23378:  (Important)  RCE     3D Builder 	  CVE-2023-23390:  (Important)  RCE     3D Builder 	  CVE-2023-21566:  (Important)  EoP     Visual Studio 	  CVE-2023-21688:  (Important)  EoP     Windows ALPC 	  CVE-2023-21717:  (Important)  EoP     Microsoft Office SharePoint 	  CVE-2023-21777:  (Important)  EoP     Azure App Service 	  CVE-2023-21800:  (Important)  EoP     Windows Installer 	  CVE-2023-21804:  (Important)  EoP     Microsoft Graphics Component 	  CVE-2023-21812:  (Important)  EoP     Windows Common Log File System Driver 	  CVE-2023-21817:  (Important)  EoP     Windows Kerberos 	  CVE-2023-21822:  (Important)  EoP     Windows Win32K 	  CVE-2023-23376:  (Important) *EoP     Windows Common Log File System Driver 	  CVE-2023-23379:  (Important)  EoP     Microsoft Defender for IoT 	  CVE-2023-21687:  (Important)  Leak    Windows HTTP.sys 	  CVE-2023-21691:  (Important)  Leak    Windows Protected EAP (PEAP) 	  CVE-2023-21693:  (Important)  Leak    Microsoft PostScript Printer Driver 	  CVE-2023-21697:  (Important)  Leak    Internet Storage Name Service 	  CVE-2023-21699:  (Important)  Leak    Internet Storage Name Service 	  CVE-2023-21714:  (Important)  Leak    Microsoft Office 	  CVE-2023-23382:  (Important)  Leak    Azure Machine Learning 	  CVE-2023-21715:  (Important) *Bypass  Microsoft Office Publisher   CVE-2023-21809:  (Important)  Bypass  Microsoft Defender for Endpoint 	  CVE-2023-21564:  (Important)  Spoof   Azure DevOps 	  CVE-2023-21570:  (Important)  Spoof   Microsoft Dynamics 	  CVE-2023-21571:  (Important)  Spoof   Microsoft Dynamics 	  CVE-2023-21572:  (Important)  Spoof   Microsoft Dynamics 	  CVE-2023-21573:  (Important)  Spoof   Microsoft Dynamics 	  CVE-2023-21721:  (Important)  Spoof   Microsoft Office OneNote 	  CVE-2023-21806:  (Important)  Spoof   Power BI 	  CVE-2023-21807:  (Important)  Spoof   Microsoft Dynamics 	  CVE-2023-21567:  (Important)  DoS     Visual Studio 	  CVE-2023-21700:  (Important)  DoS     Windows iSCSI 	  CVE-2023-21701:  (Important)  DoS     Windows Protected EAP (PEAP) 	  CVE-2023-21702:  (Important)  DoS     Windows iSCSI 	  CVE-2023-21722:  (Important)  DoS     .NET Framework 	  CVE-2023-21811:  (Important)  DoS     Windows iSCSI 	  CVE-2023-21813:  (Important)  DoS     Windows Cryptographic Services 	  CVE-2023-21816:  (Important)  DoS     Windows Active Directory 	  CVE-2023-21818:  (Important)  DoS     Windows SChannel 	  CVE-2023-21819:  (Important)  DoS     Windows Cryptographic Services 	  CVE-2023-21553:  (Unknown  )  RCE     Azure DevOps 	  

What to do?

Business users like to prioritise patches, rather than doing them all at once and hoping nothing breaks; we therefore put the Critical bugs at the top, along with the RCE holes, given that RCEs are typically used by crooks to get their initial foothold.

In the end, however, all bugs need to be patched, especially now that the updates are available and attackers can start “working backwards” by trying to figure out from the patches what sort of holes existed before the updates came out.

Reverse engineering Windows patches can be time-consuming, not least because Windows is a closed-source operating system, but it’s an awful lot easier to figure out how bugs work and how to exploit them if you’ve got a good idea where to start looking, and what to look for.

The sooner you get ahead (or the quicker you catch up, in the case of zero-day holes, which are bugs that the crooks found first), the less likely you’ll be the one who gets attacked.

So even if you don’t patch everything at once, we’re nevertheless going to say: Don’t delay/Get started today!

READ THE SOPHOSLABS ANALYSIS OF PATCH TUESDAY FOR MORE DETAILS