VERT Threat Alert: November 2023 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s November 2023 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1082 on Wednesday, November 15th.

In-The-Wild & Disclosed CVEs

CVE-2023-36033

A vulnerability in the Microsoft Desktop Window Manager (DWM) could allow an attacker to gain SYSTEM level privileges. This vulnerability has been publicly disclosed and seen active exploitation. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2023-36025

Windows SmartScreen is the technology that pops up when running a file downloaded from the Internet with a blue background that says, “Windows protected your PC”. This technology is vulnerable to a bypass when opening Internet Shortcuts (files with a ‘.URL’ extension). When a user clicks on these files, malicious software may successfully bypass the SmartScreen warning prompts. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2023-36036

Microsoft has fixed an actively exploited vulnerability in the Windows Cloud Files Mini Filter Driver which could allow an attacker to gain SYSTEM level privileges. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2023-36413

A publicly disclosed vulnerability in Microsoft Office could allow an attacker to send a user a malicious file that, when opened, would bypass Office Protected View (protected mode) and open in editing mode. A user would need to willingly open the file with the malicious content. Microsoft has reported this vulnerability as Exploitation More Likely.

CVE-2023-36038

Microsoft has resolved a publicly disclosed vulnerability that could lead to a denial of service in ASP.NET Core when processing canceled HTTP requests. According to Microsoft, this only impacts .NET 8 RC 1 running on IIS. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per-tag basis. Vulnerabilities are also color-coded to aid in identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted.
•  

Other Information

At the time of publication, there were no new advisories included with the November Security Guidance.