Microsoft security alert.
December 12, 2023
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 30 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Office Security Update for December 2023
- Severity
- Serious 3
- Qualys ID
- 110453
- Vendor Reference
- KB5002520
- CVE Reference
- CVE-2023-36009
- CVSS Scores
- Base 4.9 / Temporal 3.6
- Description
-
Microsoft has released December 2023 security updates to fix multiple security vulnerabilities.
This security update contains the following:
Office Click-2-Run and Office 365 Release Notes
KB5002520QID Detection Logic (Authenticated):
Operating System: Windows
The detection extracts the Install Path for Microsoft Office via the Windows Registry. The QID checks the file version of "graph.exe" to identify vulnerable versions of Microsoft Office.
Patched Versions for Microsoft 365 (C2R) are:
TBD Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch. - Consequence
-
Vulnerable products may be prone to Information Disclosure Vulnerability.
- Solution
-
Customers are advised to refer to these KB Article(s):
KB5002520 for more information regarding this vulnerability.Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft office December 2023
-
Microsoft Outlook Information Disclosure and Mac Spoofing Vulnerability for December 2023
- Severity
- Serious 3
- Qualys ID
- 110454
- Vendor Reference
- KB5002529, Release notes for Office for Mac
- CVE Reference
- CVE-2023-35619, CVE-2023-35636
- CVSS Scores
- Base 7.8 / Temporal 6.1
- Description
-
Microsoft has released December 2023 security updates for outlook to fix an Information Disclosure Vulnerability.
This security update contains the following:
CVE-2023-35636: Information Disclosure Vulnerability
KB5002520
Office Click-2-Run and Office 365 Release NotesCVE-2023-35619: Mac Spoofing Vulnerability
Microsoft Office LTSC for Mac 2021QID Detection Logic (Authenticated):
Operating System: Windows
The detection extracts the Install Path for Microsoft Office via the Windows Registry. The QID checks the file version of "graph.exe" to identify vulnerable versions of Microsoft Office.
Patched Versions for Microsoft 365 (C2R) are:
TBD Operating System: MacOS
This authenticated QID checks the file versions from the Microsoft advisory with the versions on affected outlook applications.Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.
- Consequence
-
Successful exploitation will lead to Mac Spoofing and/or Information Disclosure Vulnerability.
- Solution
-
Refer to Microsoft Security Guide, and KB5002520
for more details pertaining to this vulnerability.Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Outlook December 2023
-
Microsoft Defender Denial of Service (DoS) Vulnerability For December 2023
- Severity
- Critical 4
- Qualys ID
- 92084
- Vendor Reference
- CVE-2023-36010
- CVE Reference
- CVE-2023-36010
- CVSS Scores
- Base 7.8 / Temporal 5.8
- Description
-
Microsoft Malware Protection Platform is affected by a denial of service vulnerability CVE-2023-36010.
Affected Versions / Software:
Microsoft Malware Protection Platform prior to Version 4.18.23110.3QID Detection Logic (Authenticated):
The authenticated check looks for the version of "ProtectionManagement.dll" file and if the Windows Defender service is in running state. - Consequence
-
Successful exploitation of this vulnerability could lead to Denial of Service Vulnerability
- Solution
-
Users are advised to check CVE-2023-36010 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-36010
-
Microsoft Windows Security Update for December 2023
- Severity
- Urgent 5
- Qualys ID
- 92085
- Vendor Reference
- KB5033118, KB5033369, KB5033371, KB5033372, KB5033373, KB5033375, KB5033379, KB5033383, KB5033422, KB5033424, KB5033427, KB5033429, KB5033433
- CVE Reference
- CVE-2023-20588, CVE-2023-21740, CVE-2023-35628, CVE-2023-35629, CVE-2023-35630, CVE-2023-35631, CVE-2023-35632, CVE-2023-35633, CVE-2023-35634, CVE-2023-35635, CVE-2023-35639, CVE-2023-35641, CVE-2023-35642, CVE-2023-35644, CVE-2023-36003, CVE-2023-36004, CVE-2023-36005, CVE-2023-36006, CVE-2023-36011, CVE-2023-36391, CVE-2023-36696
- CVSS Scores
- Base 7.5 / Temporal 5.9
- Description
-
Microsoft Windows Security Update - December 2023
Patch version is 10.0.22621.2861 for KB5033375
Patch version is 10.0.25398.584 for KB5033383
Patch version is 10.0.19041.3803 for KB5033372
Patch version is 10.0.22000.2652 for KB5033369
Patch version is 10.0.20348.2141 for KB5033118
Patch version is 10.0.17763.5202 for KB5033371
Patch version is 6.2.9200.24612 for KB5033429
Patch version is 6.1.7601.26863 for KB5033433
Patch version is 6.1.7601.26863 for KB5033424
Patch version is 6.0.6003.22412 for KB5033422
Patch version is 6.0.6003.22412 for KB5033427
Patch version is 10.0.14393.6522 for KB5033373
Patch version is 10.0.10240.20345 for KB5033379
Patch version is 6.3.9600.21712 for KB5033420QID Detection Logic (Authenticated):
This QID checks for the file version of 'ntoskrnl.exe'. Note: This QID checks for windows Server 2022 Azuro Hotpatch through below registry key
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Update\TargetingInfo\DynamicInstalled\Hotpatch.amd64 - Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the following KB Articles associated with the update:
KB5033375
KB5033383
KB5033372
KB5033369
KB5033118
KB5033464
KB5033371
KB5033429
KB5033433
KB5033424
KB5033422
KB5033427
KB5033373
KB5033379
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5033118
KB5033369
KB5033371
KB5033372
KB5033373
KB5033375
KB5033379
KB5033383
KB5033420
KB5033422
KB5033424
KB5033427
KB5033429
KB5033433
-
Azure Connected Machine Agent Security Update for December 2023
- Severity
- Critical 4
- Qualys ID
- 92087
- Vendor Reference
- CVE-2023-35624
- CVE Reference
- CVE-2023-35624
- CVSS Scores
- Base 4.3 / Temporal 3.2
- Description
-
The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers.
Affected versions:
All versions before version 1.37
QID Detection Logic: Authenticated
On Windows, this QID detects vulnerable versions by checking the file version.
On Linux, this QID detects vulnerable versions by checking the Azure Arc-enabled version present in "/usr/share/dotnet/shared/Azure Arc-enabled/" and "/root/shared/Azure Arc-enabled" folders.
- Consequence
- An attacker who successfully exploited the vulnerability could add symlinks and cause an arbitrary file delete as SYSTEM.
- Solution
-
Customers are advised to refer to CVE-2023-35624 for more information on these vulnerabilities and their patches.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE 2023 35624
-
Microsoft Azure Stack Hub Security Updates for December 2023
- Severity
- Serious 3
- Qualys ID
- 92089
- Vendor Reference
- Azure Stack Hub
- CVE Reference
- CVE-2023-20588, CVE-2023-21740, CVE-2023-35622, CVE-2023-35628, CVE-2023-35630, CVE-2023-35632, CVE-2023-35636, CVE-2023-35638, CVE-2023-35639, CVE-2023-35641, CVE-2023-35642, CVE-2023-35643, CVE-2023-35644, CVE-2023-36003, CVE-2023-36004, CVE-2023-36005, CVE-2023-36006, CVE-2023-36009, CVE-2023-36011, CVE-2023-36012, CVE-2023-36696
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
Azure Stack Hub is an extension of Azure that provides a way to run apps in an on-premises environment and deliver Azure services in your datacenter.
A complete Qualys vulnerability scan report for Microsoft Azure Stack Hub can be obtained at Azure Stack Vulnerability Scan Report.QID Detection Logic (Authenticated):
This QID checks for the file version of ntoskrnl.exe, if this file version is less than 10.0.17763.11860, it is considered as vulnerable. - Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability.
- Solution
-
Customers are encouraged to connect with Microsoft for obtaining more information about patches and upcoming releases.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Azure Stack Hub
-
Microsoft Windows Server Multiple Security Vulnerabilities for December 2023
- Severity
- Critical 4
- Qualys ID
- 92090
- Vendor Reference
- KB5033118, KB5033371, KB5033373, KB5033383, KB5033420, KB5033422, KB5033424, KB5033427, KB5033429, KB5033433
- CVE Reference
- CVE-2023-35622, CVE-2023-35638, CVE-2023-35643, CVE-2023-36012
- CVSS Scores
- Base 7.5 / Temporal 5.5
- Description
-
Microsoft Windows Server Security Update - December 2023
Patch version is 6.3.9600.21712 for KB5033420
Patch version is 6.2.9200.24612 for KB5033429
Patch version is 10.0.14393.6522 for KB5033373
Patch version is 10.0.25398.584 for KB5033383
Patch version is 10.0.20348.2141 for KB5033118
Patch version is 6.1.7601.26863 for KB5033424
Patch version is 10.0.17763.5202 for KB5033371
Patch version is 6.1.7601.26863 for KB5033433
Patch version is 6.0.6003.22412 for KB5033422
Patch version is 6.0.6003.22412 for KB5033427QID Detection Logic (Authenticated):
This QID checks for the file version of 'dns.exe'.
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the following KB Articles associated with the update:
KB5033420
KB5033429
KB5033373
KB5033383
KB5033118
KB5033424
KB5033371
KB5033433
KB5033422
KB5033427
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5033118
KB5033371
KB5033373
KB5033383
KB5033420
KB5033422
KB5033424
KB5033427
KB5033429
KB5033433
These new vulnerability checks are included in Qualys vulnerability signature 2.5.933-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110453
- 110454
- 92084
- 92085
- 92087
- 92089
- 92090
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.