Microsoft Patch Tuesday, March 2023 Edition
Summary: Microsoft released updates fixing at least 74 security bugs in Windows and its software, two of which were already being actively attacked. The more severe is CVE-2023-23397, an Outlook flaw affecting versions from 2013 onward that can be triggered without user interaction by a booby-trapped email retrieved by the mail server, before it is viewed in the Preview Pane.
Why it matters: That Outlook bug is an NTLM relay that lets an attacker authenticate as a trusted individual without knowing their password, which Kevin Breen of Immersive Labs compared to an attacker holding a valid password with access to your systems.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-23397CVE-2023-24880
- Related
- Fat Patch Tuesday, February 2024 Edition Cyber Risks ·