Vulnerability News - August 11, 2023

Snapshot

Aug. 5, 2023 - Aug. 11, 2023

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2023-38180	Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial of service.	HIGH	Microsoft	Aug. 9, 2023
CVE-2017-18368	Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.	CRITICAL	Zyxel	Aug. 7, 2023
Newswires
Worldwide Industrial PLCs Vulnerable Due to CODESYS V3 RCE Flaws Industrial Programmable Logic Controllers (PLCs) across the globe are at risk due to 15 vulnerabilities found in the CODESYS V3 software development kit.				Aug. 11, 2023
Dell Compellent Bug Leaves VMWare Environments Vulnerable to Attacks Dell Compellent, a storage array service, has a significant vulnerability due to hardcoded credentials that could allow attackers to seize control of enterprise VMware environments.				Aug. 10, 2023
CISA Uncovers 'Whirlpool' Backdoor in Barracuda ESG Attacks The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has identified a new backdoor malware, dubbed 'Whirlpool', utilized in attacks on compromised Barracuda Email Security Gateway (ESG) devices.				Aug. 10, 2023
CISA Highlights Exploited Flaw in .NET and Visual Studio The Cybersecurity and Infrastructure Security Agency (CISA) in the United States has flagged a zero-day vulnerability that is impacting Microsoft's .NET and Visual Studio products.				Aug. 10, 2023
New Side-Channel Attacks Impacting Modern CPUs: Collide+Power, Downfall, and Inception Cybersecurity researchers have unveiled three new side-channel attacks that could potentially compromise modern Central Processing Units (CPUs) and leak sensitive information.				Aug. 9, 2023
Microsoft Office Defense-In-Depth Update Thwarts Actively Exploited RCE Attack Chain Microsoft has released a crucial update for its Office software to counter a remote code execution (RCE) vulnerability, known as CVE-2023-36884, which has previously been exploited in attacks.				Aug. 8, 2023
Critical Zero-Day Vulnerabilities Expose Industrial Communications to Threats The TETRA communications protocol, which powers industrial control systems worldwide, has been found to contain multiple zero-day vulnerabilities.				Aug. 8, 2023
Critical Citrix Vulnerability Being Actively Exploited: Thousands of Instances Still at Risk Several threat actors are capitalizing on a critical vulnerability in Citrix networking products, even after Citrix rolled out a patch for its NetScaler ADC and NetScaler Gateway three weeks ago.				Aug. 8, 2023
Microsoft's August 2023 Patch Tuesday Addresses Two Zero-Days Among 87 Vulnerabilities Microsoft's August 2023 Patch Tuesday has rolled out security patches for a total of 87 vulnerabilities, including two zero-days that are currently being exploited and 23 remote code execution (RCE) bugs.				Aug. 8, 2023
Rise in Ransomware Attacks Through Zero-Day Exploits: An Analysis A 143% increase in ransomware victims was observed between Q1 2022 and Q1 2023, with attackers pivoting from phishing to exploiting zero-day vulnerabilities and one-day flaws for network intrusion.				Aug. 8, 2023
Critical Citrix ADC Vulnerability: PoC Released for 0-day Flaw - CVE-2023-3519 A proof-of-concept (PoC) for a critical vulnerability, CVE-2023-3519, in Citrix ADC has been made public.				Aug. 7, 2023
Mallox Ransomware Group Enhances Malware Variants and Evasion Tactics The Mallox ransomware group, also known as TargetCompany, Fargo, and Tohnichi, has stepped up its attacks on organizations with vulnerable SQL servers.				Aug. 7, 2023
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2023-36910 (8)	Microsoft Message Queuing Remote Code Execution Vulnerability	CRITICAL	Microsoft	Remote Code Execution
CVE-2023-35385 (8)	Microsoft Message Queuing Remote Code Execution Vulnerability	CRITICAL	Microsoft	Remote Code Execution
CVE-2023-36911 (7)	Microsoft Message Queuing Remote Code Execution Vulnerability	CRITICAL	Microsoft	Remote Code Execution
CVE-2023-21709 (5)	Microsoft Exchange Server Elevation of Privilege Vulnerability	CRITICAL	Microsoft	Risk Context N/A
CVE-2023-29328 (5)	Microsoft Teams Remote Code Execution Vulnerability	HIGH	Microsoft	Remote Code Execution
CVE-2023-38180 (16)	.NET and Visual Studio Denial of Service Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2023-36884 (16)	Windows Search Remote Code Execution Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available
CVE-2022-40982 (9)	Information exposure through microarchitectural state after transient execution in certain vector execution units for some In...	MEDIUM		Actively Exploited
CVE-2022-23825 (6)	Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to informa...	MEDIUM	Fedoraproject, Debian, Vmware	Remote Code Execution
CVE-2023-20569 (9)	A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction.	N/A		Risk Context N/A

CISA Known Exploited Vulnerabilities

CISA added two vulnerabilities to the known exploited vulnerabilities list.

Microsoft — .NET Core and Visual Studio

CVE-2023-38180 / Added: Aug. 9, 2023

HIGH CVSS 7.50 EPSS Score 0.05 EPSS Percentile 14.01

Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial of service.

Headlines

Aug. 11, 2023 - CISA Adds Microsoft .NET Vulnerability to KEV Catalog Due to Active Exploitation
Aug. 10, 2023 - CISA adds actively exploited flaw in .NET, Visual Studio to its Known Exploited Vulnerabilities catalog
Aug. 10, 2023 - CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio
Aug. 9, 2023 - A piñata of patches for Microsoft in August
Aug. 9, 2023 - Microsoft Patches 80+ Flaws Including Two Zero-Days
Aug. 9, 2023 - Microsoft Releases Patches for 74 New Vulnerabilities in August Update
Aug. 9, 2023 - Microsoft Patch Tuesday, August 2023 Edition –
Aug. 9, 2023 - Microsoft Patches 89 Security Vulnerabilities, Including Two Zero-Days (CVE-2023-38180 & CVE-2023-36884)
Aug. 8, 2023 - Microsoft discloses three critical RCEs
Aug. 8, 2023 - Microsoft, Intel lead this month's security fix emissions
Aug. 8, 2023 - Microsoft Patch Tuesday for August 2023 fixed 2 actively exploited flaws
Aug. 8, 2023 - Microsoft Fixes 74 CVEs in August Update
Aug. 8, 2023 - August 2023 Patch Tuesday: Microsoft fixes critical bugs in Teams, MSMQ
Aug. 8, 2023 - Critical Patches Issued for Microsoft Products, August 08, 2023
Aug. 8, 2023 - Six critical vulnerabilities included in August’s Microsoft security update
Aug. 8, 2023 - Microsoft August 2023 Patch Tuesday warns of 2 zero-days, 87 flaws

Zyxel — P660HN-T1A Routers

CVE-2017-18368 / Added: Aug. 7, 2023

CRITICAL CVSS 9.80 EPSS Score 97.52 EPSS Percentile 99.97

Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.

Headlines

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2023-36910

CRITICAL CVSS 9.80 EPSS Score 0.24 EPSS Percentile 60.99

Remote Code Execution

Published: Aug. 8, 2023

Microsoft Message Queuing Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 22h2, Windows 10 21h2, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 10, Windows 11 22h2, Windows Server 2016, Windows Server 2022, Windows 10 1809, Windows 11 21h2, Windows 10 1607

Quotes

Stops the attack chain leading to the Windows Search security feature bypass vulnerability
The user needs to download and open a specially crafted file from a website to trigger the attack
It utilizes a network attack vector, has a low complexity of attack, and doesn't necessitate privileges or user interaction
An attacker can plant a malicious file evading Mark of the Web (MOTW) defenses which can result in code execution on the victim system
Microsoft also released ADV230003, a defense-in-depth update designed to stop the attack chain associated that leads to the exploitation of this CVE

Headlines

CVE-2023-35385

CRITICAL CVSS 9.80 EPSS Score 0.24 EPSS Percentile 60.99

Remote Code Execution

Published: Aug. 8, 2023

Microsoft Message Queuing Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 22h2, Windows 10 21h2, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 11 22h2, Windows Server 2022, Windows Server 2016, Windows 10 1809, Windows 11 21h2, Windows 10 1607, Windows 10 1507

Quotes

Stops the attack chain leading to the Windows Search security feature bypass vulnerability
The user needs to download and open a specially crafted file from a website to trigger the attack
It utilizes a network attack vector, has a low complexity of attack, and doesn't necessitate privileges or user interaction
An attacker can plant a malicious file evading Mark of the Web (MOTW) defenses which can result in code execution on the victim system
This volume of fixes is the highest we’ve seen in the last few years, although it’s not unusual to see Microsoft ship a large number of patches right before the Black Hat USA conference. It will be interesting to see if the August release, which comes the day before the Black Hat briefings, will also be a large release

Headlines

CVE-2023-36911

CRITICAL CVSS 9.80 EPSS Score 0.24 EPSS Percentile 60.99

Remote Code Execution

Published: Aug. 8, 2023

Microsoft Message Queuing Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Quotes

Stops the attack chain leading to the Windows Search security feature bypass vulnerability
The user needs to download and open a specially crafted file from a website to trigger the attack
It utilizes a network attack vector, has a low complexity of attack, and doesn't necessitate privileges or user interaction
An attacker can plant a malicious file evading Mark of the Web (MOTW) defenses which can result in code execution on the victim system

Headlines

CVE-2023-21709

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 38.06

Risk Context N/A

Published: Aug. 8, 2023

Microsoft Exchange Server Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

Leaves the server in a non-working state
It utilizes a network attack vector, has a low complexity of attack, and doesn't necessitate privileges or user interaction
Microsoft recommends installing the Office updates discussed in this advisory as well as installing the Windows updates from August 2023
Microsoft also released ADV230003, a defense-in-depth update designed to stop the attack chain associated that leads to the exploitation of this CVE

Headlines

CVE-2023-29328

HIGH CVSS 8.80 EPSS Score 0.24 EPSS Percentile 60.99

Remote Code Execution

Published: Aug. 8, 2023

Microsoft Teams Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Product Impacted: Teams

Quotes

Stops the attack chain leading to the Windows Search security feature bypass vulnerability
The user needs to download and open a specially crafted file from a website to trigger the attack
Microsoft recommends installing the Office updates discussed in this advisory as well as installing the Windows updates from August 2023

Headlines

CVE-2023-38180

HIGH CVSS 7.50 EPSS Score 0.05 EPSS Percentile 14.01

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Aug. 8, 2023

.NET and Visual Studio Denial of Service Vulnerability

Vendor Impacted: Microsoft

Products Impacted: .net Core And Visual Studio, .net, Asp.net Core, Visual Studio 2022

Quotes

Stops the attack chain leading to the Windows Search security feature bypass vulnerability
Original version was published without a RSRC section, which contains resource information for a module
Proof-of-concept exploit code is available, or an attack demonstration is not practical for most systems
It utilizes a network attack vector, has a low complexity of attack, and doesn't necessitate privileges or user interaction
An attacker can plant a malicious file evading Mark of the Web (MOTW) defenses which can result in code execution on the victim system
Microsoft recommends installing the Office updates discussed in this advisory as well as installing the Windows updates from August 2023
Microsoft also released ADV230003, a defense-in-depth update designed to stop the attack chain associated that leads to the exploitation of this CVE
An attacker who successfully exploits this vulnerability cannot access existing files but can write or overwrite file contents, which potentially may cause the system to become unavailable
This volume of fixes is the highest we’ve seen in the last few years, although it’s not unusual to see Microsoft ship a large number of patches right before the Black Hat USA conference. It will be interesting to see if the August release, which comes the day before the Black Hat briefings, will also be a large release

Headlines

CVE-2023-36884

HIGH CVSS 7.50 EPSS Score 62.54 EPSS Percentile 97.37

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: July 11, 2023

Windows Search Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 22h2, Word, Windows 10 21h2, Windows Server 2008, Office, Windows Server 2019, Windows Server 2012, Windows 11, Windows Server 2022, Windows Server 2016, Office And Windows, Windows 10 1809, Windows 11 21h2, Windows 10 1607, Windows 10 1507

Quotes

A series of remote code execution vulnerabilities
That provides enhanced security as a defense in depth measure
Stops the attack chain leading to the Windows Search security feature bypass vulnerability
Original version was published without a RSRC section, which contains resource information for a module
Microsoft has released an update for Microsoft Office that provides enhanced security as a defense in depth measure
It utilizes a network attack vector, has a low complexity of attack, and doesn't necessitate privileges or user interaction
An attacker can plant a malicious file evading Mark of the Web (MOTW) defenses which can result in code execution on the victim system
Microsoft recommends installing the Office updates discussed in this advisory as well as installing the Windows updates from August 2023
Microsoft also released ADV230003, a defense-in-depth update designed to stop the attack chain associated that leads to the exploitation of this CVE
C:\Program Files... 7.94 Crash Report Mark Stafford via dev (Jul 16) Uninstalled older version, first. Version: 7.94 Traceback (most recent call last): File
An attacker who successfully exploits this vulnerability cannot access existing files but can write or overwrite file contents, which potentially may cause the system to become unavailable
Last month, Microsoft initially announced a series of zero-day vulnerabilities in a variety of Microsoft products that were discovered and exploited in the wild. They were assigned a single placeholder: CVE-2023-36884
This volume of fixes is the highest we’ve seen in the last few years, although it’s not unusual to see Microsoft ship a large number of patches right before the Black Hat USA conference. It will be interesting to see if the August release, which comes the day before the Black Hat briefings, will also be a large release

Headlines

CVE-2022-40982

MEDIUM CVSS 6.50

Actively Exploited

Published: Aug. 11, 2023

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Quotes

Only the very recent 12th-gen Intel CPUs are not affected
Leaks the content of the internal vector register file during speculative execution
Stops the attack chain leading to the Windows Search security feature bypass vulnerability
Downfall attacks target a critical weakness found in billions of modern processors used in personal and cloud computers
[CVE-2022-40982] is caused by memory optimization features in Intel processors that unintentionally reveal internal hardware registers to software. This allows untrusted software to access data stored by other programs, which should not be normally be accessible
The vulnerability is caused by memory optimization features in Intel processors that unintentionally reveal internal hardware registers to software. This allows untrusted software to access data stored by other programs, which should not be normally be accessible. I discovered that the Gather instruction, meant to speed up accessing scattered data in memory, leaks the content of the internal vector register file during speculative execution. To exploit this vulnerability, I introduced Gather Data Sampling (GDS) and Gather Value Injection (GVI) techniques

Headlines

CVE-2022-23825

MEDIUM CVSS 6.50 EPSS Score 0.05 EPSS Percentile 12.96

Remote Code Execution

Published: July 14, 2022

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.

Vendors Impacted: Fedoraproject, Debian, Vmware

Products Impacted: Esxi, Debian Linux, Fedora

Quotes

AMD believes this vulnerability is only potentially exploitable locally, such as via downloaded malware
Downfall attacks target a critical weakness found in billions of modern processors used in personal and cloud computers
As in the movie of the same name, Inception plants an ‘idea’ in the CPU while it is in a sense ‘dreaming’, to make it take wrong actions based on supposedly self conceived experiences. Using this approach, Inception hijacks the transient control-flow of return instructions on all AMD Zen CPUs

Headlines

CVE-2023-20569

CVSS Not Assigned EPSS Score 0.05 EPSS Percentile 14.03

Risk Context N/A

Published: Aug. 8, 2023

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled?address, potentially leading to information disclosure.

Quotes

AMD believes this vulnerability is only potentially exploitable locally, such as via downloaded malware
Original version was published without a RSRC section, which contains resource information for a module
Downfall attacks target a critical weakness found in billions of modern processors used in personal and cloud computers
An attacker who successfully exploits this vulnerability cannot access existing files but can write or overwrite file contents, which potentially may cause the system to become unavailable

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

August 11, 2023

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

August 11, 2023

Snapshot

CISA Known Exploited Vulnerabilities

Newswires

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Microsoft — .NET Core and Visual Studio

Zyxel — P660HN-T1A Routers

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe