Spring is officially here, but not everything comes down to flowers and baby rabbits. There are those who eagerly await Microsoft’s Patch Tuesday rollout.

And, as you know, it’s the second Tuesday of the month, which means that Windows users are looking towards the tech giant in hopes that some of the flaws they’ve been struggling with will finally get fixed.

We have already taken the liberty of providing the direct download links for the cumulative updates released today for Windows 7, 8.1, 10, and 11, but now it’s time to talk CVEs again.

For March, Microsoft released 74 new patches, one less than last month, which is still more than some people were expecting for the third month of 2023.

These software updates address CVEs in:

• Windows and Windows components
• Office and Office Components
• Exchange Server
• .NET Core and Visual Studio Code
• 3D Builder and Print 3D
• Microsoft Azure and Dynamics 365
• Defender for IoT and the Malware Protection Engine
• Microsoft Edge (Chromium-based)

You probably want to know more on the matter, so let’s dive right into it and see what all the fuss is about this month.

74 new patches released to fix serious security issues

Let’s just say that February was far from being a busy month for Microsoft, and still, they managed to release a total of 75 updates.

However, it seems that the situation isn’t getting any better, since the tech giant released only one less update this month, for a total of 74.

Please keep in mind that, out of all the patches released today, six are rated Critical, 67 are rated Important, and only one is rated Moderate in severity.

Furthermore, remember that this is one of the largest volumes we’ve seen from Microsoft for a March release in quite some time.

We have to say that it is a bit unusual to see half of the Patch Tuesday release address remote code execution (RCE) bugs.

It’s important to be aware that two of the new CVEs are listed as under active attack at the time of release with one of those also being listed as publicly known.

That being said, let’s take a closer look at some of the more interesting updates for this month, starting with the bugs under active attack.

Let’s look at CVE-2023-23397 for one second. Even though technically a spoofing bug, experts consider the result of this vulnerability to be an authentication bypass.

Thus, it allows a remote, unauthenticated attacker to access a user’s Net-NTLMv2 hash just by sending a specially crafted e-mail to an affected system.

CVE-2023-23392 could actually allow a remote, unauthenticated attacker to execute code at system level without user interaction.

Know that combination makes this bug wormable, at least through systems that meet the target requirements, and the target system needs to have HTTP/3 enabled and set to use buffered I/O.

There’s a CVSS 9.8 bug in RPC Runtime that also has some wormable potential. That being said, unlike ICMP, it is a good idea to block RPC traffic (specifically TCP port 135) at the perimeter.

Also, there’s a fair amount of Elevation of Privilege (EoP) bugs receiving patches this month, and the majority of these require the attacker to execute their code on a target to escalate privileges.

Moving on to the information disclosure vulnerabilities receiving patches this month, the vast majority simply result in info leaks consisting of unspecified memory contents.

However, there are a couple of exceptions. The bug in Microsoft Dynamics 365 could leak a verbose error message that attackers could use to create malicious payloads.

And, the two bugs in OneDrive for Android could leak certain Android/local URIs that OneDrive can access.

Once again, you will most likely need to get this patch from the Google Play store if you haven’t configured automatic app updates.

We have to point out that there are three additional DoS fixes released this month. There’s no additional info about the patches for Windows Secure Channel or the Internet Key Exchange (IKE) Extension.

On that note, we can expect a successful exploit of these bugs to interfere with authentication processes, so make sure you keep that in mind at all times.

Feel free to check each individual CVE and find out more about what it means, how it manifests, and what scenarios can malicious third parties use to exploit them.

Have you found any other issues after installing this month’s security updates? Share your experience with us in the comments section below.

Yes, you guessed it! The third round of the monthly Patch Tuesday updates of 2023 have arrived, and they bring an entire array of changes for both Windows 10 and Windows 11, regardless of whether it is a newer or an older version.

The March 2023 Patch Tuesday updates are expected to fix some of the issues that were still pending, and in the article below we will be looking to see exactly what we get.

We’ve included detailed changelogs for each cumulative update, and we will also be providing you with direct download links from Microsoft’s Windows Update Catalog, so you know that they are secure.

Alternatively, you can always use other methods to get the latest updates, including:

• The Windows Update menu on your OS
• The WSUS (Windows Server Update Service)
• Group Policies set up by your admins if you’re part of a larger network.

Changes included in the March 2003 Patch Tuesday Updates

Windows 11

As most of you know by now, Microsoft released its latest operating system, Windows 11, on the 5th of October, 2021.

Five months after the general rollout, the new OS seems to become increasingly stable and far less buggy than we’ve gotten used to.

You might also like to know that the 22H2 version of Windows 11, the operating system’s first major update, is out now and you can already install it.

It will, most likely, come in the first half of the year, so we might just get it until the summer. Of course, there is a possibility that the Redmond tech giant could postpone to the third, or fourth quarter.

Cumulative update name

KB5022836

[DIRECT DOWNLOAD LINK]

Windows 10 versions 21H2, 21H1, and 20H2

Windows 10 v21H2 is the latest major version of Windows 10, and as such has the most experimental features on it.

Fortunately, most bugs that were first present when it was first made available have been weeded out, and this version of Windows 10 is far more stable.

Cumulative update name

KB5023696 

Improvements and fixes

• This update implements phase three of Distributed Component Object Model (DCOM) hardening. See KB5004442. After you install this update, you cannot turn off the changes using the registry key.
• This update addresses an issue that affects a computer account and Active Directory. When you reuse an existing computer account to join an Active Directory domain, joining fails. This occurs on devices that have installed Windows updates dated October 11, 2022 or later. The error message is, “Error 0xaac (2732): NERR_AccountReuseBlockedByPolicy: ‘An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.’” For more information, see KB5020276.

Known issues

• Devices with Windows installations created from custom offline media or custom ISO image might have Microsoft Edge Legacy removed by this update, but not automatically replaced by the new Microsoft Edge. This issue is only encountered when custom offline media or ISO images are created by slipstreaming this update into the image without having first installed the standalone servicing stack update (SSU) released March 29, 2021 or later.

[DIRECT DOWNLOAD LINK]

Windows 10, version 1809

This version of the OS is outdated and will no longer receive any updates from the tech company. Users that are still running this old version on their devices are strongly advised to choose a more recent one to update to.

If you still want to use Windows 10 and are not willing to upgrade to 11, you don’t have to do so right away. After all, Microsoft announced that the support for Windows 10 will go on until 2025.

Cumulative update name

KB5023702 

Improvements and fixes:

• This update implements phase three of Distributed Component Object Model (DCOM) hardening. See KB5004442. After you install this update, you cannot turn off the changes using the registry key.
• This update addresses an issue that affects the registry size. It grows very large. This occurs because the registry entries are not removed when users sign out of an Azure Virtual Desktop (AVD) environment that uses FSlogix.
• This update affects the United Mexican States. This update supports the government’s daylight saving time change order for 2023.
• This update addresses an issue that might affect lsass.exe. It might stop responding when it sends a Lightweight Directory Access Protocol (LDAP) query to a domain controller that has a very large LDAP filter.
• This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). LSASS might stop responding. This occurs after you run Sysprep on a domain-joined machine.
• This update addresses an issue that affects a computer account and Active Directory. When you reuse an existing computer account to join an Active Directory domain, joining fails. This occurs on devices that have installed Windows updates dated October 11, 2022 or later. The error message is, “Error 0xaac (2732): NERR_AccountReuseBlockedByPolicy: ‘An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.’” For more information, see KB5020276.
• This update addresses an issue that affects the Routing and Remote Access Service (RRAS). RRAS cannot accept any new incoming virtual private network (VPN) connections.
• This update addresses an issue that affects Cluster Name Object of Failover Clustering on Azure virtual machines (VM). The issue stops you from repairing it.

Known Issues:

• After installing KB5001342 or later, the Cluster Service might fail to start because a Cluster Network Driver is not found.

[DIRECT DOWNLOAD LINK]

Windows 10, version 1607

Windows 10, version 1607 has reached the end of service for all of its available editions. Update to the latest version of Windows 10 in order to keep your system protected.

Cumulative update name

KB5023697 

Improvements and fixes

• This update implements phase three of Distributed Component Object Model (DCOM) hardening. See KB5004442. After you install this update, you cannot turn off the changes using the registry key.
• This update affects the United Mexican States. This update supports the government’s daylight saving time change order for 2023.
• This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). LSASS might stop responding. This occurs after you run Sysprep on a domain-joined machine.
• This update addresses an issue that affects a computer account and Active Directory. When you reuse an existing computer account to join an Active Directory domain, joining fails. This occurs on devices that have installed Windows updates dated October 11, 2022 or later. The error message is, “Error 0xaac (2732): NERR_AccountReuseBlockedByPolicy: ‘An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.’” For more information, see KB5020276.

[DIRECT DOWNLOAD LINK]

This wraps up our brief overview of this month’s Patch Tuesday updates, and we hope that by reading the changelogs above, you will make a more informed decision regarding whether to update or not.

However, keep in mind that if you choose not to update for too long, you will risk exposing yourself to subsequent malware attacks that usually follow the Patch Tuesday updates, called Exploit Wednesday.

However, if you do prefer to wait out until Microsoft fixes the issues detected in this month’s updates, know that you can always choose to delay the Update notification that you get for up to 35 days.

All in all, it is important to remember that the Patch Tuesday updates are released for a reason, so installing them, eventually, is something that you should do.

Was this article helpful to you? Let us know in the comments section below.