September’s Patch Tuesday Unleashes 61 CVEs

September 2023 Key Vulnerabilities
CVE-2023-38149
Windows TCP/IP Denial of Service Vulnerability – [Important]
This vulnerability, tagged with a base score of 7.5/10, is a concern for all networked systems. This Denial of Service vulnerability allows an attacker via a network vector to disrupt the service without any user authentication or high complexity. However, systems with disabled IPv6 are not affected.

CVE-2023-36761
Microsoft Word Information Disclosure Vulnerability [Important]
Rated at a base score of 6.2/10, this vulnerability poses a risk of exposing NTLM hashes – essentially, cryptographic representations of user or device credentials. This vulnerability is currently being exploited in the wild.

Exposed NTLM hashes pose significant risks, as they are essentially digital keys to a user's credentials. If a malicious actor gains access to these hashes, they can potentially impersonate the user, gaining unauthorized access to sensitive data and systems. They could also conduct pass-the-hash attacks, where the attacker uses the hashed version of a password to authenticate themselves without needing to decrypt it. 

This sort of breach can lead to compromises in data integrity and security, opening the door for further exploits and even causing a cascading effect of system vulnerabilities. It's paramount that systems are patched promptly to protect against such threats. -Tom Bowyer, Manager, Product Security

8 Visual Studio Vulnerabilities
This Patch Tuesday identified vulnerabilities linked to Visual Studio, each presenting remote code execution risks. CVE-2023-36796, CVE-2023-36794, CVE-2023-36792, and CVE-2023-36793 all have a base score of 7.8/10 and require user interaction for exploitation. All are listed as critical vulnerabilities except for CVE-2023-36794 which is rated as Important. CVE-2023-36742 has a lower base score of 6.5/10, with a similar requirement for user interaction.

Four other Visual Studio vulnerabilities were released with attack vectors specified around denial of service (CVE-2023-36799 and CVE-2023-36742), and elevation of privileges (CVE-2023-36758 and CVE-2023-36759).

Remote code execution and elevation of privilege vulnerabilities in Visual Studio pose a real and substantial danger. This type of vulnerability can give an attacker the ability to run malicious code on your system, potentially gaining full control over the affected environment. 

In the worst-case scenario, this could mean the theft or corruption of proprietary source code, the introduction of backdoors, or malicious tampering that could turn your application into a launchpad for attacks on others. -Tom Bowyer, Manager, Product Security

CVE-2023-29332
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability [Critical]
This vulnerability, with a base score of 7.5/10, could allow an attacker to gain Cluster Administrator privileges. The attack vector is the network, and the complexity is low, meaning no significant prior knowledge or user interaction is required for an attack.

The Azure Kubernetes Service vulnerability is a wake-up call for the cloud-native community and reaffirms the necessity of securing our Kubernetes environments. The fact that an attacker could potentially gain Cluster Administrator privileges with low complexity is a staggering security concern.