Vulnerability News - April 14, 2023

Snapshot

April 8, 2023 - April 14, 2023

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2023-20963	Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.	HIGH	Android	April 13, 2023
CVE-2023-29492	Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.	N/A	Novi Survey	April 13, 2023
CVE-2023-28252	Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.	HIGH	Microsoft	April 11, 2023
CVE-2023-28205	Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.	HIGH	Apple	April 10, 2023
CVE-2023-28206	Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.	HIGH	Apple	April 10, 2023
Newswires
Emergency Chrome Update Addresses First Zero-Day of 2023 Google has issued an emergency security update for its Chrome browser to tackle the first zero-day vulnerability exploited in attacks since the beginning of the year.				April 14, 2023
Google and CISA Issue Warning on Android Flaw Exploited by Chinese App Google and the US Cybersecurity and Infrastructure Security Agency (CISA) have issued a warning about an Android vulnerability, CVE-2023-20963, that was reportedly exploited as a zero-day by the Chinese shopping app Pinduoduo, affecting millions of devices.				April 14, 2023
Windows Admins Urged to Patch Critical MSMQ QueueJumper Bug Security researchers and experts are warning of a critical vulnerability in the Windows Message Queuing (MSMQ) middleware service that has been patched by Microsoft during this month's Patch Tuesday.				April 12, 2023
Microsoft Offers Guidance on Detecting BlackLotus UEFI Bootkit Attacks Microsoft has provided guidance to help organizations identify if their machines have been targeted or compromised by the BlackLotus UEFI bootkit, which exploits the CVE-2022-21894 vulnerability.				April 12, 2023
Fortinet Addresses Critical Vulnerability in Data Analytics Solution Cybersecurity solutions provider Fortinet has announced the release of security updates for multiple products, including patches for a critical vulnerability in its FortiPresence data analytics solution.				April 12, 2023
Windows Zero-Day Exploited in Nokoyawa Ransomware Attacks A Windows zero-day vulnerability, tracked as CVE-2023-28252, has been fixed by Microsoft in its April 2023 Patch Tuesday updates.				April 12, 2023
Microsoft Patches Windows Zero-Day Exploited in Nokoyawa Ransomware Attacks Microsoft has patched a zero-day vulnerability in the Windows Common Log File System (CLFS) that has been actively exploited by cybercriminals to escalate privileges and deploy Nokoyawa ransomware payloads.				April 11, 2023
3CX Confirms North Korean Hackers Behind Supply Chain Attack VoIP communications company 3CX has confirmed that a North Korean hacking group was behind last month's supply chain attack.				April 11, 2023
CISA Directs Government Agencies to Update Apple Devices by May 1st The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to address two security vulnerabilities actively exploited in the wild to hack iPhones, Macs, and iPads.				April 10, 2023
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2023-21554 (13)	Microsoft Message Queuing Remote Code Execution Vulnerability	CRITICAL		Remote Code Execution Public Exploits Available
CVE-2023-28250 (5)	Windows Pragmatic General Multicast Remote Code Execution Vulnerability	CRITICAL	Microsoft	Remote Code Execution
CVE-2023-28205 (17)	A use after free issue was addressed with improved memory management.	HIGH	Apple	CISA Known Exploited
CVE-2023-28206 (17)	An out-of-bounds write issue was addressed with improved input validation.	HIGH	Apple	CISA Known Exploited
CVE-2023-28220 (5)	Layer 2 Tunneling Protocol Remote Code Execution Vulnerability	HIGH	Microsoft	Remote Code Execution
CVE-2023-28219 (5)	Layer 2 Tunneling Protocol Remote Code Execution Vulnerability	HIGH	Microsoft	Remote Code Execution
CVE-2023-28231 (6)	DHCP Server Service Remote Code Execution Vulnerability	HIGH	Microsoft	Remote Code Execution
CVE-2023-28252 (23)	Windows Common Log File System Driver Elevation of Privilege Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware
CVE-2022-37969 (8)	Windows Common Log File System Driver Elevation of Privilege Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2013-3900 (5)	The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2...	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

CISA Known Exploited Vulnerabilities

CISA added five vulnerabilities to the known exploited vulnerabilities list.

Android — Framework

CVE-2023-20963 / Added: April 13, 2023

HIGH CVSS 7.80

Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.

Headlines

April 14, 2023 - Google, CISA Warn of Android Flaw After Reports of Chinese App Zero-Day Exploitation
April 14, 2023 - Severe Android and Novi Survey Vulnerabilities Under Active Exploitation

Novi Survey — Novi Survey

CVE-2023-29492 / Added: April 13, 2023

CVSS Not Assigned

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

Headlines

April 14, 2023 - Google, CISA Warn of Android Flaw After Reports of Chinese App Zero-Day Exploitation

Microsoft — Windows

CVE-2023-28252 / Added: April 11, 2023

HIGH CVSS 7.80

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

Headlines

Apple — Multiple Products

CVE-2023-28205 / Added: April 10, 2023

HIGH CVSS 8.80

Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.

Headlines

Apple — iOS, iPadOS, and macOS

CVE-2023-28206 / Added: April 10, 2023

HIGH CVSS 8.60

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.

Headlines

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2023-21554

CRITICAL CVSS 9.80

Remote Code Execution Public Exploits Available

Published: April 11, 2023

Microsoft Message Queuing Remote Code Execution Vulnerability

Quotes

[T]hrough the course of the investigation the FBI was not able to confirm that this incident was initiated by a targeted cyber intrusion of Oldsmar
We now know the attack vector sends packets to the service port 1801/tcp
Aware of past instances of this type of vulnerability being exploited
This vulnerability has a low complexity and uses a local attack vector, requiring only low privileges to exploit and no interaction from the user. It affects Windows Server versions from 2008 onward, as well as all versions of Windows 10
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
A specially crafted malicious MSMQ packet to a MSMQ server
This vulnerability leverages existing system access to actively exploit a device and is a result of how the CLFS driver interacts with objects in memory on a system
Over the last two years, attackers appear to have found success targeting CLFS in order to elevate privileges as part of post-compromise activity
[This bug] allows a remote, unauthenticated attacker to run their code with elevated privileges on affected servers with the Message Queuing service enabled. This service is disabled by default but is commonly used by many contact center applications

Headlines

CVE-2023-28250

CRITICAL CVSS 9.80

Remote Code Execution

Published: April 11, 2023

Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 1607, Windows 10 1809, Windows 10 1507, Windows 11 22h2, Windows Server 2012, Windows Server 2016, Windows 10 20h2, Windows Server 2008, Windows Server 2022, Windows 10 21h2, Windows 11 21h2, Windows 10 22h2, Windows Server 2019

Quotes

We now know the attack vector sends packets to the service port 1801/tcp
A specially crafted malicious MSMQ packet to a MSMQ server
This vulnerability leverages existing system access to actively exploit a device and is a result of how the CLFS driver interacts with objects in memory on a system
Over the last two years, attackers appear to have found success targeting CLFS in order to elevate privileges as part of post-compromise activity

Headlines

CVE-2023-28205

HIGH CVSS 8.80

CISA Known Exploited

Published: April 10, 2023

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.7.5 and iPadOS 15.7.5, Safari 16.4.1, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor Impacted: Apple

Products Impacted: Iphone Os, Safari, Macos, Multiple Products, Ipados

Quotes

Introduce malware and monitoring software onto devices
If it seems familiar, that’s because there was a similar 0-day patched in the same component just two months ago
Apple is aware of a report that [these issues] may have been actively exploited
Ironically, kernel-level bugs that rely on a booby-trapped app are often not much use on their own against iPhone or iPad users, because Apple’s strict App Store ‘walled garden’ rules make it hard for attackers to trick you installing a rogue app in the first place
Apple is aware of a report that this issue may have been actively exploited
Developed by a commercial cyber-surveillance company and sold to governments hackers to carry out targeted spyware attacks
It is interesting that Amnesty International's Security Lab was one of the organizations involved in finding reporting the issue
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited
Is aware of a report that this issue may have been actively exploited

Headlines

CVE-2023-28206

HIGH CVSS 8.60

CISA Known Exploited

Published: April 10, 2023

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.7.5 and iPadOS 15.7.5, macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Big Sur 11.7.6, macOS Ventura 13.3.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Vendor Impacted: Apple

Products Impacted: Ios, Ipados, And Macos, Iphone Os, Ipados, Macos

Quotes

Introduce malware and monitoring software onto devices
If it seems familiar, that’s because there was a similar 0-day patched in the same component just two months ago
Apple is aware of a report that [these issues] may have been actively exploited
Ironically, kernel-level bugs that rely on a booby-trapped app are often not much use on their own against iPhone or iPad users, because Apple’s strict App Store ‘walled garden’ rules make it hard for attackers to trick you installing a rogue app in the first place
Apple is aware of a report that this issue may have been actively exploited
Developed by a commercial cyber-surveillance company and sold to governments hackers to carry out targeted spyware attacks
It is interesting that Amnesty International's Security Lab was one of the organizations involved in finding reporting the issue
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited
Is aware of a report that this issue may have been actively exploited

Headlines

CVE-2023-28220

HIGH CVSS 8.10

Remote Code Execution

Published: April 11, 2023

Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Quotes

A specially crafted malicious MSMQ packet to a MSMQ server
If it seems familiar, that’s because there was a similar 0-day patched in the same component just two months ago
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges

Headlines

CVE-2023-28219

HIGH CVSS 8.10

Remote Code Execution

Published: April 11, 2023

Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Quotes

A specially crafted malicious MSMQ packet to a MSMQ server
If it seems familiar, that’s because there was a similar 0-day patched in the same component just two months ago
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges

Headlines

CVE-2023-28231

HIGH CVSS 8.00

Remote Code Execution

Published: April 11, 2023

DHCP Server Service Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2012, Windows Server 2016, Windows Server 2008, Windows Server 2022, Windows Server 2019

Quotes

A specially crafted malicious MSMQ packet to a MSMQ server
If it seems familiar, that’s because there was a similar 0-day patched in the same component just two months ago
This vulnerability leverages existing system access to actively exploit a device and is a result of how the CLFS driver interacts with objects in memory on a system

Headlines

CVE-2023-28252

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware

Published: April 11, 2023

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 1607, Windows 10 1809, Windows 10 1507, Windows 11 22h2, Windows Server 2012, Windows Server 2016, Windows, Windows 10 20h2, Windows Server 2008, Windows Server 2022, Windows 10 21h2, Windows 11 21h2, Windows 10 22h2, Windows Server 2019

Quotes

Wouldn’t it be nice if you could write the code, and then you could take it to any compliant compiler on any system, and the code would, within the limits of the system, behave the same
Introduce malware and monitoring software onto devices
Since at least June 2022, we’ve identified five different exploits used in attacks on retail & wholesale, energy, manufacturing, healthcare, software development, and other industries
We now know the attack vector sends packets to the service port 1801/tcp
This group is notable for its use of a large number of similar but unique Common Log File System (CLFS) driver exploits that were likely developed by the same exploit author. Since at least June 2022, we’ve identified five different exploits used in attacks on retail & wholesale, energy, manufacturing, healthcare, software development and other industries
Kaspersky researchers uncovered the vulnerability in February as a result of additional checks into a number of attempts to execute similar elevation of privilege exploits on Microsoft Windows servers belonging to different small and medium-sized businesses in the Middle Eastern and North American regions
This vulnerability has a low complexity and uses a local attack vector, requiring only low privileges to exploit and no interaction from the user. It affects Windows Server versions from 2008 onward, as well as all versions of Windows 10
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
The discovered exploit uses the vulnerability to corrupt another specially crafted base log file object in a way that a fake element of the base log file gets treated as a real one
A specially crafted malicious MSMQ packet to a MSMQ server
If it seems familiar, that’s because there was a similar 0-day patched in the same component just two months ago
This vulnerability leverages existing system access to actively exploit a device and is a result of how the CLFS driver interacts with objects in memory on a system
Over the last two years, attackers appear to have found success targeting CLFS in order to elevate privileges as part of post-compromise activity
[This bug] allows a remote, unauthenticated attacker to run their code with elevated privileges on affected servers with the Message Queuing service enabled. This service is disabled by default but is commonly used by many contact center applications
Windows Common Log File System Driver Elevation Of Privilege Vulnerability

Headlines

CVE-2022-37969

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 13, 2022

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 8.1, Windows 7, Windows 10, Windows Server 2012, Windows Server 2016, Windows, Windows Server 2008, Windows Server 2022, Windows 11, Windows Server 2019

Quotes

Introduce malware and monitoring software onto devices
Since at least June 2022, we’ve identified five different exploits used in attacks on retail & wholesale, energy, manufacturing, healthcare, software development, and other industries
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
If it seems familiar, that’s because there was a similar 0-day patched in the same component just two months ago
This vulnerability leverages existing system access to actively exploit a device and is a result of how the CLFS driver interacts with objects in memory on a system
Kaspersky researchers uncovered the vulnerability in February as a result of additional checks into a number of attempts to execute similar elevation of privilege exploits on Microsoft Windows servers belonging to different small and medium-sized businesses in the Middle Eastern and North American regions
Windows Common Log File System Driver Elevation Of Privilege Vulnerability

Headlines

CVE-2013-3900

HIGH CVSS 7.60

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Dec. 11, 2013

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability."

Vendor Impacted: Microsoft

Products Impacted: Windows 8.1, Windows Server 2003, Windows Server 2019, Windows 7, Windows 10, Windows Server 2012, Windows Server 2016, Windows Vista, Winverifytrust Function, Windows Server 2008, Windows Server 2022, Windows Xp, Windows 11, Windows Rt 8.1

Quotes

On Windows, the attacker used DLL side-loading to achieve persistence for TAXHAUL malware. DLL side-loading triggered infected systems to execute the attacker’s malware within the context of legitimate Microsoft Windows binaries, reducing the likelihood of malware detection. The persistence mechanism also ensures the attacker malware is loaded at system start-up, enabling the attacker to retain remote access to the infected system over the internet
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
This vulnerability leverages existing system access to actively exploit a device and is a result of how the CLFS driver interacts with objects in memory on a system
Over the last two years, attackers appear to have found success targeting CLFS in order to elevate privileges as part of post-compromise activity
Based on the Mandiant investigation into the 3CX intrusion and supply chain attack thus far, they attribute the activity to a cluster named UNC4736. Mandiant assesses with high confidence that UNC4736 has a North Korean nexus

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

April 14, 2023

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

April 14, 2023

Snapshot

CISA Known Exploited Vulnerabilities

Newswires

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Android — Framework

Novi Survey — Novi Survey

Microsoft — Windows

Apple — Multiple Products

Apple — iOS, iPadOS, and macOS

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe