Register for the webinar Bridging the Board - CISO Gap

Patch Tuesday Patch Tuesday

January 11, 2023

Patch Tuesday Update - January 2023

It’s a new year and the battle in cybersecurity goes on. The latest war front is this month’s Microsoft Patch Tuesday releases. For January, Microsoft announced patches for 98 vulnerabilities, including 11 that Microsoft has rated critical, 1 zero-day (CVE-2023-21674) and 1 advisory (ADV220005).

The headline issues this month are:

CVE-2023-21674, Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

CVE-2023-21745, Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange 2019 is particularly exposed to this month’s vulnerabilities. It has three vulnerabilities with CVSS score of 7.5+  (including CVE-2023-21745), that  have an access vector which allows for exploitation as follows:

  • Adjacent Network Access
  • Low Attack Complexity`
  • Low Privilege Requirements
  • No User Interaction Requirements

CVE-2023-21762  is a vulnerability that you’ll want to pay close attention to. It is a known exploited vulnerability which affects the advanced local procedure call (ALPC) system within Windows Server 2012 R2. ALPC is an inter-process communication facility for high-speed message passing. It is not directly available through the Windows API; it is an internal mechanism available only to Windows operating system components. This known exploitable vulnerability has the ability to change the scope of the user interaction. It also has the ability to be accessed from the local network, with low privileges, and no user interaction, allowing a user to change the scope of their privileges to more privileged position.

CVE-2023-21745, CVE-2023-21761, and CVE-2023-21764 are also vulnerabilities relating to Microsoft Exchange server 2019.  All have a CVSS base score between 7.5 and 8 and allow for the impact of Spoofing, Information Disclosure, Elevation of Privileges respectively.  Given the pervasiveness of the Exchange Server these CVE’s deserve particular attention.

Microsoft also released updates to the 3 existing CVEs below:

  • CVE-2022-41099, BitLocker Security Feature Bypass Vulnerability (Nov 8, 2022)
  • CVE-2022-41113, Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (No 8, 2022)
  • CVE-2022-47211, Microsoft Office Graphics Remote Code Execution Vulnerability (Dec 13, 2022)

Breaking down the 48 vulnerabilities further, we can see that elevation of privileges and remote code executions lead the way this month in terms of impact type.

Breakdown of CVEs by impact type
Breakdown of CVEs by impact type

Furthermore, as can be seen below, these vulnerabilities vary in terms of how likely they are to be exploited, with 10% of the vulnerabilities this month either already exploited or highly likely to be exploited.

Breakdown of CVEs by exploit likelihood
Breakdown of CVEs by exploit likelihood

As always, Balbix can identify all affected assets within 1 hour of release. There are no scans to run. Balbix customers simply search for the CVE name in their Balbix dashboard to view the list of affected assets. Users can also use the filtered search functionality to search for the CVE by site, subnet, location, or other distinguishing factors