补丁星期二- 2023年12月

最后更新于2023年12月15日(星期五)20:50:24 GMT

微软将在今年12月解决34个漏洞 星期二补丁, including a single zero-day vulnerability 和 three critical remote code execution (RCE) vulnerabilities. December 星期二补丁 has historically seen fewer patches than a typical month, 这一趋势将在2023年继续. This total does not include eight browser vulnerabilities published earlier this month. At time of writing, none of the vulnerabilities patched today are yet added to the CISA KEV list.

某些AMD处理器:零日信息泄露

本月唯一的零日漏洞是 cve - 2023 - 20588, which describes a potential information disclosure due to a flaw in 某些AMD处理器型号 如AMD公告所列. AMD states that a divide-by-zero on these processor models could potentially return speculative data. AMD believes the potential impact of the vulnerability is low since local access is required; however, Microsoft ranks severity as important under its own proprietary severity scale. The vulnerability is patched at the OS level in all supported versions of Windows, even as far back as Windows Server 2008 for Azure-hosted assets participating in the Extended Security Update (ESU) program.

展望:无交互的临界RCE

cve - 2023 - 35628 describes a critical RCE vulnerability in the MSHTML proprietary browser engine still used by Outlook, 等, 呈现HTML内容. Of particular note: the most concerning exploitation scenario leads to exploitation as soon as Outlook retrieves 和 processes the specially crafted malicious email. This means that exploitation could occur before the user interacts with the email in any way; not even the Preview Pane is required in this scenario. 其他 attack vectors exist: the user could also click a malicious link received via email, 即时消息, 或者其他媒介. Assets where Internet Explorer 11 has been fully disabled are still vulnerable until patched; the MSHTML engine remains installed within Windows regardless of the status of IE11.

Internet连接共享:关键RCE

This month also brings patches for a pair of critical RCE vulnerabilities in Internet Connection Sharing. cve - 2023 - 35630 和 cve - 2023 - 35641 有许多相似之处:一个基本的CVSS v3.1分8分.8, 微软临界严重性排名, 低攻击复杂度, 并且可能在目标机器上的SYSTEM上下文中执行, 尽管通知不指定执行上下文. Description of the exploitation method does differ between the two, however.

cve - 2023 - 35630 requires the attacker to modify an option->length field in a DHCPv6 DHCPV6_MESSAGE_INFORMATION_REQUEST input message. 开发 cve - 2023 - 35641 也可以通过恶意制作的DHCP消息发送到ICS服务器, 但该报告没有给出进一步的线索.

大致相似 2023年9月的ICS漏洞 导致了ICS服务器上SYSTEM上下文中的RCE. 在这三种情况下, a mitigating factor is the requirement for the attack to be launched from the same network segment as the ICS server. It seems improbable that either of this month’s ICS vulnerabilities are exploitable against a target on which ICS is not running; Microsoft did not explicitly deny the possibility, 但随后对该建议的更新 cve - 2023 - 35641 是否澄清利用需要启用ICS.

假日季更新

Notable by their absence this month: no security patches for Exchange, SharePoint, Visual Studio/.. NET或SQL Server. There are also no lifecycle transitions for Microsoft products this month, although a number of Windows Server 2019 editions 和 Office components will transition out of mainstream support 和 into extended support from January 2024.

总结图表

汇总表

Azure的漏洞

浏览器的漏洞

ESU Windows漏洞

Microsoft Dynamics漏洞

Microsoft Dynamics Azure漏洞

Microsoft Office漏洞

System Center漏洞

Windows操作系统漏洞

更新

• 2023-12-14微软更新了该建议 cve - 2023 - 35641 to confirm that ICS must be enabled for exploitation to be possible.