{"id":45583,"date":"2023-05-10T15:14:11","date_gmt":"2023-05-10T14:14:11","guid":{"rendered":"https:\/\/www.n-able.com\/?p=45583"},"modified":"2023-05-19T11:19:09","modified_gmt":"2023-05-19T10:19:09","slug":"patch-tuesday-may-2023","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/patch-tuesday-may-2023","title":{"rendered":"Patch Tuesday May 2023: Vulnerability Count Dips but UEFI Bootkits Deserve Your Attention"},"content":{"rendered":"

With only 38 new vulnerabilities being addressed this month, is this a calm before the storm? From my previous experience, dips in the number of addressed vulnerabilities on any given Microsoft Patch Tuesday are often followed by a sharp increase over the following months. While you shouldn\u2019t plan IT strategies around anecdotes or aching joints, there is some wisdom to be gained from reading the winds. Since we have so few Microsoft updates for this month, take the opportunity to get ahead while you can and brace for a larger number of vulnerabilities and the possible need for manual mitigations to be applied after the next Patch Tuesday. <\/span><\/p>\n

Microsoft Vulnerabilities <\/span><\/h2>\n

Microsoft has released fixes or updates for a total of 52 different vulnerabilities. Some of these are simply republishing older fixes, like CVE-2013-3900<\/span><\/a>, or updates to existing vulnerabilities like CVE-2023-23398<\/span><\/a>. Of the 38 new vulnerabilities three are zero-days that are either under active exploitation or are designated as exploitation more likely. <\/span><\/p>\n

CVE-2023-29325<\/a><\/span> likely deserves a position as a priority one item for you and your teams to address this month. This zero-day is not under active exploitation as of publishing this blog, but the delivery vector is trivial to take advantage of for threat actors once a proof of concept is released. According to Microsoft, \u201c<\/span>In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted email to the victim. Exploitation of the vulnerability might involve either a victim opening a specially crafted email with an affected version of Microsoft Outlook software, or a victim’s Outlook application displaying a preview of a specially crafted email. This could result in the attacker executing remote code on the victim’s machine.\u201d While there are prior actions required to leverage this exploit, attacks that chain vulnerabilities together are not uncommon and there is a high likelihood this will become part of widespread attack campaigns.<\/span><\/p>\n

CVE-2023-24932<\/a><\/span> is a Secure Boot Security Feature Bypass vulnerability affecting Windows Server 2008 and newer OS builds, so almost every Windows system currently in production. Worth noting is that the fix released by Microsoft updates the Windows Boot Manager, but does not mitigate against the vulnerability by default. If you want to take advantage of this fix you\u2019ll need to make sure you follow Microsoft\u2019s guidance<\/span><\/a>. You will also need to take into consideration that this vulnerability is leveraged by the BlackLotus UEFI bootkit<\/span><\/a> in the wild. <\/span><\/p>\n

CVE-2023-29336<\/a><\/span> is also a major concern this month. This zero-day Win32k Elevation of Privilege vulnerability is under active exploitation, but Microsoft has not released any information on how the vulnerability is exploited. <\/span><\/p>\n

Microsoft 365 and Click to Run<\/span><\/h2>\n

As a reminder and review from last month, modern Microsoft 365 apps leverage a different update mechanism than older versions of Microsoft Office. Make sure you review your patching tools and processes to ensure M365 Apps have a defined update process<\/a> in place. We have an automation item available in the Automation Cookbook for N‑sight and N‑central <\/span>partners which allows them to check and update Microsoft 365 versions that leverage Microsoft\u2019s Click to Run executable that is included in all installs of Microsoft 365 apps. <\/span><\/p>\n