...
Вчера был второй по счёту вторник марта, а значит, Microsoft подготовила очередной набор патчей. В общей сложности разработчики устранили 83 уязвимости, две из которых активно эксплуатируются в реальных кибератаках.
Девять брешей из набора получили статус критических, с их помощью атакующие могут выполнить код удалённо, вызвать отказ в обслуживании (DoS) и повысить свои права в системе. Баги распределились по категориям следующим образом:
- 21 дыра, способная привести к повышению привилегий;
- 2 бага обхода защитных механизмов;
- 27 уязвимостей удалённого выполнения кода;
- 15 проблем раскрытия информации;
- 4 DoS-бреши;
- 10 проблем спуфинга;
- 1 дыра в Edge.
Что касается уязвимостей нулевого дня (0-day), Microsoft устранила две особо опасных проблемы:
- CVE-2023-23397 — повышение привилегий в Microsoft Outlook. Злоумышленники эксплуатируют её с помощью специально подготовленных электронных писем. Устройство жертвы принудительно подключается к удалённому URL и передаёт туда хеш Net-NTLMv2 Windows-аккаунта.
- CVE-2023-24880 — обход защитной функции Windows SmartScreen. Атакующие готовят специальный вредоносный файл, который помогает им обойти Mark of tde Web (MOTW). Соответствующий эксплойт помогает распространять вредоносные программы.
Полный список уязвимостей, устранённых в этом месяце: выглядит так:
| Затронутый компонент | CVE-идентификатор | Название CVE | Уровень опасности |
| Azure | CVE-2023-23408 | Azure Apache Ambari Spoofing Vulnerability | Высокая |
| Client Server Run-time Subsystem (CSRSS) | CVE-2023-23409 | Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability | Высокая |
| Client Server Run-time Subsystem (CSRSS) | CVE-2023-23394 | Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability | Высокая |
| Internet Control Message Protocol (ICMP) | CVE-2023-23415 | Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability | Критическая |
| Mariner | CVE-2023-0567 | Неизвестно | Неизвестно |
| Mariner | CVE-2023-20052 | Неизвестно | Неизвестно |
| Mariner | CVE-2023-20032 | Неизвестно | Неизвестно |
| Microsoft Bluetootd Driver | CVE-2023-23388 | Windows Bluetootd Driver Elevation of Privilege Vulnerability | Высокая |
| Microsoft Dynamics | CVE-2023-24920 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | Высокая |
| Microsoft Dynamics | CVE-2023-24879 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | Высокая |
| Microsoft Dynamics | CVE-2023-24919 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | Высокая |
| Microsoft Dynamics | CVE-2023-24891 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | Высокая |
| Microsoft Dynamics | CVE-2023-24922 | Microsoft Dynamics 365 Information Disclosure Vulnerability | Высокая |
| Microsoft Dynamics | CVE-2023-24921 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | Высокая |
| Microsoft Edge (Chromium-based) | CVE-2023-1236 | Chromium: CVE-2023-1236 Inappropriate implementation in Internals | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1235 | Chromium: CVE-2023-1235 Type Confusion in DevTools | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1213 | Chromium: CVE-2023-1213 Use after free in Swiftshader | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-24892 | Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability | Высокая |
| Microsoft Edge (Chromium-based) | CVE-2023-1234 | Chromium: CVE-2023-1234 Inappropriate implementation in Intents | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1223 | Chromium: CVE-2023-1223 Insufficient policy enforcement in Autofill | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1222 | Chromium: CVE-2023-1222 Heap buffer overflow in Web Audio API | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1221 | Chromium: CVE-2023-1221 Insufficient policy enforcement in Extensions API | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1229 | Chromium: CVE-2023-1229 Inappropriate implementation in Permission prompts | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1228 | Chromium: CVE-2023-1228 Insufficient policy enforcement in Intents | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1224 | Chromium: CVE-2023-1224 Insufficient policy enforcement in Web Payments API | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1220 | Chromium: CVE-2023-1220 Heap buffer overflow in UMA | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1216 | Chromium: CVE-2023-1216 Use after free in DevTools | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1215 | Chromium: CVE-2023-1215 Type Confusion in CSS | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1214 | Chromium: CVE-2023-1214 Type Confusion in V8 | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1219 | Chromium: CVE-2023-1219 Heap buffer overflow in Metrics | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1218 | Chromium: CVE-2023-1218 Use after free in WebRTC | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1217 | Chromium: CVE-2023-1217 Stack buffer overflow in Crash reporting | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1230 | Chromium: CVE-2023-1230 Inappropriate implementation in WebApp Installs | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1232 | Chromium: CVE-2023-1232 Insufficient policy enforcement in Resource Timing | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1233 | Chromium: CVE-2023-1233 Insufficient policy enforcement in Resource Timing | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2023-1231 | Chromium: CVE-2023-1231 Inappropriate implementation in Autofill | Неизвестно |
| Microsoft Graphics Component | CVE-2023-24910 | Windows Graphics Component Elevation of Privilege Vulnerability | Высокая |
| Microsoft Office Excel | CVE-2023-23398 | Microsoft Excel Spoofing Vulnerability | Высокая |
| Microsoft Office Excel | CVE-2023-23396 | Microsoft Excel Denial of Service Vulnerability | Высокая |
| Microsoft Office Excel | CVE-2023-23399 | Microsoft Excel Remote Code Execution Vulnerability | Высокая |
| Microsoft Office Outlook | CVE-2023-23397 | Microsoft Outlook Elevation of Privilege Vulnerability | Критическая |
| Microsoft Office SharePoint | CVE-2023-23395 | Microsoft SharePoint Server Spoofing Vulnerability | Высокая |
| Microsoft OneDrive | CVE-2023-24890 | Microsoft OneDrive for iOS Security Feature Bypass Vulnerability | Высокая |
| Microsoft OneDrive | CVE-2023-24930 | Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability | Высокая |
| Microsoft OneDrive | CVE-2023-24882 | Microsoft OneDrive for Android Information Disclosure Vulnerability | Высокая |
| Microsoft OneDrive | CVE-2023-24923 | Microsoft OneDrive for Android Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24907 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24857 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24868 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24872 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24876 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24913 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24864 | Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24866 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24906 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24867 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24863 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24858 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24911 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24870 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24909 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-23406 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-23413 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft PostScript Printer Driver | CVE-2023-24856 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft Printer Drivers | CVE-2023-24865 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | Высокая |
| Microsoft Printer Drivers | CVE-2023-23403 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability | Высокая |
| Microsoft Windows Codecs Library | CVE-2023-23401 | Windows Media Remote Code Execution Vulnerability | Высокая |
| Microsoft Windows Codecs Library | CVE-2023-23402 | Windows Media Remote Code Execution Vulnerability | Высокая |
| Office for Android | CVE-2023-23391 | Office for Android Spoofing Vulnerability | Высокая |
| Remote Access Service Point-to-Point Tunneling Protocol | CVE-2023-23404 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | Критическая |
| Role: DNS Server | CVE-2023-23400 | Windows DNS Server Remote Code Execution Vulnerability | Высокая |
| Role: Windows Hyper-V | CVE-2023-23411 | Windows Hyper-V Denial of Service Vulnerability | Критическая |
| Service Fabric | CVE-2023-23383 | Service Fabric Explorer Spoofing Vulnerability | Высокая |
| Visual Studio | CVE-2023-23618 | Gitdub: CVE-2023-23618 Git for Windows Remote Code Execution Vulnerability | Высокая |
| Visual Studio | CVE-2023-22743 | Gitdub: CVE-2023-22743 Git for Windows Installer Elevation of Privilege Vulnerability | Высокая |
| Visual Studio | CVE-2023-23946 | Gitdub: CVE-2023-23946 mingit Remote Code Execution Vulnerability | Высокая |
| Visual Studio | CVE-2023-22490 | Gitdub: CVE-2023-22490 mingit Information Disclosure Vulnerability | Высокая |
| Windows Accounts Control | CVE-2023-23412 | Windows Accounts Picture Elevation of Privilege Vulnerability | Высокая |
| Windows Bluetootd Service | CVE-2023-24871 | Windows Bluetootd Service Remote Code Execution Vulnerability | Высокая |
| Windows Central Resource Manager | CVE-2023-23393 | Windows BrokerInfrastructure Service Elevation of Privilege Vulnerability | Высокая |
| Windows Cryptographic Services | CVE-2023-23416 | Windows Cryptographic Services Remote Code Execution Vulnerability | Критическая |
| Windows Defender | CVE-2023-23389 | Microsoft Defender Elevation of Privilege Vulnerability | Высокая |
| Windows HTTP Protocol Stack | CVE-2023-23392 | HTTP Protocol Stack Remote Code Execution Vulnerability | Критическая |
| Windows HTTP.sys | CVE-2023-23410 | Windows HTTP.sys Elevation of Privilege Vulnerability | Высокая |
| Windows Internet Key Exchange (IKE) Protocol | CVE-2023-24859 | Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability | Высокая |
| Windows Kernel | CVE-2023-23420 | Windows Kernel Elevation of Privilege Vulnerability | Высокая |
| Windows Kernel | CVE-2023-23422 | Windows Kernel Elevation of Privilege Vulnerability | Высокая |
| Windows Kernel | CVE-2023-23421 | Windows Kernel Elevation of Privilege Vulnerability | Высокая |
| Windows Kernel | CVE-2023-23423 | Windows Kernel Elevation of Privilege Vulnerability | Высокая |
| Windows Partition Management Driver | CVE-2023-23417 | Windows Partition Management Driver Elevation of Privilege Vulnerability | Высокая |
| Windows Point-to-Point Protocol over Etdernet (PPPoE) | CVE-2023-23407 | Windows Point-to-Point Protocol over Etdernet (PPPoE) Remote Code Execution Vulnerability | Высокая |
| Windows Point-to-Point Protocol over Etdernet (PPPoE) | CVE-2023-23385 | Windows Point-to-Point Protocol over Etdernet (PPPoE) Elevation of Privilege Vulnerability | Высокая |
| Windows Point-to-Point Protocol over Etdernet (PPPoE) | CVE-2023-23414 | Windows Point-to-Point Protocol over Etdernet (PPPoE) Remote Code Execution Vulnerability | Высокая |
| Windows Remote Procedure Call | CVE-2023-21708 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | Критическая |
| Windows Remote Procedure Call Runtime | CVE-2023-23405 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | Высокая |
| Windows Remote Procedure Call Runtime | CVE-2023-24869 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | Высокая |
| Windows Remote Procedure Call Runtime | CVE-2023-24908 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | Высокая |
| Windows Resilient File System (ReFS) | CVE-2023-23419 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | Высокая |
| Windows Resilient File System (ReFS) | CVE-2023-23418 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | Высокая |
| Windows Secure Channel | CVE-2023-24862 | Windows Secure Channel Denial of Service Vulnerability | Высокая |
| Windows SmartScreen | CVE-2023-24880 | Windows SmartScreen Security Feature Bypass Vulnerability | Средняя |
| Windows TPM | CVE-2023-1017 | CERT/CC: CVE-2023-1017 TPM2.0 Module Library Elevation of Privilege Vulnerability | Критическая |
| Windows TPM | CVE-2023-1018 | CERT/CC: CVE-2023-1018 TPM2.0 Module Library Elevation of Privilege Vulnerability | Критическая |
| Windows Win32K | CVE-2023-24861 | Windows Graphics Component Elevation of Privilege Vulnerability | Высокая |
