Microsoft patches 12 critical vulnerabilities, nine of which are in Layer 2 Tunneling Protocol

Summary: Microsoft disclosed 104 vulnerabilities across its software and services, the most in a single Patch Tuesday since July, including 12 rated critical, nine of which are remote code execution flaws in the Layer 2 Tunneling Protocol. Two other flaws, CVE-2023-36563 in WordPad and CVE-2023-41763 in Skype, have already been exploited in the wild and have proof-of-concept code available, though Microsoft rates them only important.
Bottom line: The nine Layer 2 Tunneling Protocol flaws sit in the VPN path, and the source notes that a Fortinet SSL VPN flaw, CVE-2018-13379, topped CISA's 2022 list of most-exploited vulnerabilities despite being disclosed in 2018 - a reminder that VPN exposure has a long tail.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-13379 CVE-2023-35349 CVE-2023-36563 CVE-2023-36718 CVE-2023-41763
Related: Patch Tuesday, October 2023 Edition Cyber Risks ·
CVE-2023-36563: Microsoft Word Pad Information Disclosure Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023
CVE-2023-41763: Microsoft Skype for Business Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023