Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities
Summary: Microsoft's March 2023 security update disclosed 83 vulnerabilities across its hardware and software, eight of them critical, including two already exploited in the wild. The exploited flaws are CVE-2023-24880, a Windows SmartScreen security feature bypass that lets a crafted file evade Mark of the Web defenses, and CVE-2023-23397, an Outlook privilege escalation that transmits the Windows account's Net-NTLMv2 hash to an adversary as soon as the email is retrieved by the server, without the user opening or previewing it.
Why it matters: CVE-2023-23397 fires before any user action, so the usual 'don't click the link' training offers no protection against an attacker harvesting Net-NTLMv2 hashes from your mail flow. Three other critical flaws carry a 9.8 CVSS score, and Microsoft rates the ICMP one, CVE-2023-23415, as more likely to be exploited, with SYSTEM-level remote code execution at stake.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-21708CVE-2023-23392CVE-2023-23397CVE-2023-23410CVE-2023-23415CVE-2023-24880
- Related
- Microsoft Patch Tuesday, March 2023 Edition Cyber Risks ·Fat Patch Tuesday, February 2024 Edition Cyber Risks ·