Flash Notice: Microsoft Patches Two Zero-Day Vulnerabilities

overview

This week, Microsoft fixed two zero-day vulnerabilities tracked as CVE-2023-36761 and CVE-2023-36802. The first vulnerability, CVE-2023-36761 (CVSS 6.2) is a Microsoft Word information disclosure vulnerability, while the second vulnerability, CVE-2023-36802 (CVSS 7.8) is a Microsoft streaming service proxy elevation of privilege vulnerability.  

CVE-2023-36761 lets attackers steal NTLM hashes when you open a document, even in the preview pane. They can then use these NTLM hashes for unauthorized access to accounts. This means that attackers can use the stolen hashes in NTLM Relay attacks to escalate their privileges and gain control over accounts and systems.  

CVE-2023-36802 allows attackers to gain SYSTEM privileges - the highest level of access on a Windows system. Once attackers have gained SYSTEM privileges, they can install, modify, or delete software and files without restrictions, as well as access sensitive system data.  

Both vulnerabilities have been exploited in the wild but have been patched by Microsoft. Avertium recommends that users implement the appropriate patches for both vulnerabilities as soon as possible.

avertium's recommendationS

• CVE-2023-36761  
  • Avertium recommends applying the Microsoft Word update for CVE-2023-36761. You may find patch guidance in Microsoft’s advisory under Security Updates. 
• CVE-2023-36802 
  • Avertium recommends applying the Windows update for CVE-2023-36761. You may find patch guidance in Microsoft’s advisory under Security Updates.  

INDICATORS OF COMPROMISE (IoCs)

How Avertium is Protecting Our CUSTOMERS

• Fusion MXDR for Microsoft combines Avertium's Fusion MXDR approach with Microsoft Security Solutions, creating the first MDR offering that integrates all aspects of security operations into an active and threat-informed XDR solution. Leveraging Microsoft's comprehensive and cost-effective technology, Fusion MXDR for Microsoft delivers a release of cyber energy, encompassing implementation, optimization, ongoing management, and tuning. 
  
  
• Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so you’ll have no more blind spots, weak links, or fire drills. See every threat in your attack surface, every device, every entry point, and every vulnerability. Our Attack Surface Management services include:  
  
  
  • Risk Assessments 
  • Pen Testing and Social Engineering  
  • Infrastructure Architecture and Integration  
  • Zero Trust Network Architecture 
  • Vulnerability Management 

SUPPORTING DOCUMENTATION