Toni Dimaano Tech 01.11.2023 01:Jan AM EST

Microsoft's First Patch Tuesday For January 2023 Fixes 98 Vulnerabilities

Microsoft's January 2023 Patch Tuesday patches 98 vulnerabilities in total, including an actively exploited zero-day vulnerability, and 11 flaws that are critical.

According to Bleeping Computer, the company assigned this level of severity to the flaws because they provide remote code execution, disallow security measures, or elevate privileges.

The New Patch Tuesday Aims To Address An Active Zero-Day

The zero-day vulnerability, one that is being actively exploited, and one that has been made public are all fixed in this month's Patch Tuesday.

It is important to note that a vulnerability is considered a zero-day by Microsoft if it has been made public or is being actively used without an approved fix.

Researchers at the anti-malware company Avast discovered the zero-day, which was used in live assaults to raise privileges and go through a browser's sandbox mitigation.

Microsoft, as has become standard, remains tight-lipped about the vulnerability or the attacks, but a Redmond advisory identifies the weakness as CVE-2023-21674.

The CVE-2023-21674 bug is listed as "Exploitation Detected," however the company made no IOCs or other data available to aid defenders in their search for evidence of compromise, Security Week writes.

According to a Microsoft advisory, a hacker who was successful in exploiting this vulnerability might take control of the system.

The tech giant also warned that technical information on CVE-2023-21549, a privilege escalation problem in the Windows SMB Witness Service, is publicly available.

An attacker might use a specially written malicious script to execute an RPC call to an RPC host and gain elevated privileges on the server in order to exploit this issue.

According to the company, an attacker who was successful in exploiting this flaw might carry out RPC operations that are only permitted for privileged accounts.

Microsoft Names Other Vulnerabilities That Were Fixed By The Patch Tuesday

Code execution, denial-of-service, and privilege-escalation problems in a variety of Windows OS and system components are all fixed by the January batch of patches.

Bleeping Computer lists the complete number of bugs in each vulnerability category, and they are as follows:

39 Elevation of Privilege Vulnerabilities
4 Security Feature Bypass Vulnerabilities
33 Remote Code Execution Vulnerabilities
10 Information Disclosure Vulnerabilities
10 Denial of Service Vulnerabilities
2 Spoofing Vulnerabilities

The flagship Office productivity suite, .Net Core and Visual Studio Code, Microsoft Exchange Server, Windows Print Spooler, Windows Defender, and Windows BitLocker all also have significant security flaws.

It is notable that Microsoft patches were released on the same day that software company Adobe patched at least 29 security flaws in a number of enterprise-focused products.

The most significant update fixes critical-severity problems that leave users of Windows and macOS vulnerable to code execution assaults, affecting the widely used Adobe Acrobat and Reader products.

Additionally, Zoom, a leader in video messaging, has recently provided patches for a number of security flaws that put users of Windows and macOS at risk of hostile hacker attacks.

Attacks using privilege escalation on the Windows and macOS platforms could take advantage of the vulnerabilities in the enterprise-focused Zoom Rooms software, Security Week says.