Microsoft rolls out fixes for 69 CVEs through the June 2023 Patch Tuesday

It’s June and we are already enjoying the summer, but Windows users are also looking towards Microsoft, in hopes that some of the flaws they’ve been struggling with will finally get fixed.

We’ve already provided the direct download links for the cumulative updates released today for Windows 10 and 11, but now it’s time to talk about Critical Vulnerabilities and Exposures again.

This month, the Redmond-based tech giant released 69 new patches, which is a lot more than some people were expecting in the middle of the summer.

These software updates address CVEs in:

• Microsoft Windows and Windows Components
• Office and Office Components
• Exchange Server
• Microsoft Edge (Chromium-based)
• SharePoint Server
• .NET and Visual Studio
• Microsoft Teams; Azure DevOps
• Microsoft Dynamics
• Remote Desktop Client

We’re going to take a more in-depth look at this release and see exactly what vulnerabilities we can scratch off our lists.

Microsoft managed to eliminate 69 OS vulnerabilities

It goes without saying that this isn’t either one of the busiest or the lightest months for Microsoft security experts.

You might like to know that, out of the 69 new CVEs released, six are rated Critical, 62 are rated Important, and one is rated Moderate in severity.

Notably, this volume of fixes is a bit larger than what we all expected for June, but not extraordinary, so there’s no need to worry.

It’s important to know that none of the new bugs patched this month are listed as publicly known or under active attack at the time of release.

Let’s talk about CVE-2023-32031 for a second. This vulnerability, in case you didn’t already know, is actually a bypass of both CVE-2022-41082 and CVE-2023-21529.

Remember that the former was listed as being under active exploit, and this specific flaw exists within the Command class.

The issue started from the lack of proper validation of user-supplied data, which can result in the deserialization of untrusted data.

Even though this does require the attacker to have an account on the Exchange server, successful exploitation could lead to executing code with SYSTEM privileges.

Looking at CVE-2023-29363/32014/32015, we can tell that these three bugs look identical on paper, and all are listed as a CVSS 9.8.

They allowed a remote, unauthenticated attacker to execute code on an affected system where the message queuing service is running in a Pragmatic General Multicast (PGM) Server environment.

While not enabled by default, PGM isn’t an uncommon configuration, so we do hope these bugs get fixed before any active exploitation starts.

There are only two other Critical-rated bugs in this month’s release, with the first appearing to be all supported versions of .NET, .NET Framework, and Visual Studio.

In fact, it’s an open-and-own sort of exploit, but judging by the Critical rating, it appears there are no warning dialogs when opening the dodgy file.

The second Critical-rated fix for June addresses a Denial-of-Service (DoS) bug in the Hyper-V server, so the Critical rating implies a guest OS could potentially shut down the host OS, or at least cause some form of a DoS condition.

The June 2023 Patch Tuesday rollout includes fixes for four security feature bypass (SFB) bugs, and two of these involve bypassing the check RPC procedure.

If left unchecked, they could allow the execution of RCE procedures that should otherwise be restricted when making calls to an SMB server.

Know that the bug in the RDP requires someone open a specially crafted file, but if they can convince the user to take that action, the attacker could bypass certificate or private key authentication when establishing a remote desktop protocol session.

Let’s also mention the final SFB patch, which is the Low-severity bug in Edge that could allow attackers to bypass the permissions dialog feature when clicking on a URL.

Going through the remaining DoS fixes for June, the vast majority offer no additional details, so it’s not clear whether an attack would only impact the component or the entire system.

These above-mentioned bugs in the CryptoAPI service may impact authentication actions, but that’s just speculation based on the component.

Was this article helpful to you? Share your opinion in the comments section below.