Microsoft has addressed 97 current vulnerabilities this April Patch Tuesday, with an additional eight beforehand launched patches up to date and re-released. There have been studies of a vulnerability (CVE-2023-28252) exploited within the wild, making it a “Patch Now” launch.
This replace cycle impacts Home windows desktops, Microsoft Workplace, and Adobe Reader. No updates for Microsoft Trade this month. The staff at Utility Readiness has supplied a useful infographic that outlines the dangers related to every of the updates for this April replace cycle.
Recognized points
Every month, Microsoft features a listing of identified points that relate to the working system and platforms which are included on this replace cycle.
- Home windows 11 22H2: After putting in this or later updates, Home windows gadgets with some third-party UI customization apps won’t begin up. Microsoft is at the moment investigating this difficulty.
- Updates launched February 14, 2023 or later won’t be supplied from some Home windows Server Replace Companies (WSUS) servers to Home windows 11, model 22H2. The updates will obtain to the WSUS server however won’t propagate additional to shopper gadgets. Microsoft is engaged on this difficulty. An replace is predicted quickly.
And for these gaming cowboys on the market, it seems that Purple Lifeless Redemption 2 is useless on arrival — no less than for this April replace. For these IT directors who copy giant recordsdata on Home windows 11 techniques (we all know who you might be), you might be simply going to have to attend (a little bit longer), as there may be nonetheless a buffering downside for multigigabit community transfers on Microsoft’s newest desktop OS.
Main revisions
This month Microsoft has revealed a number of main revisions for earlier updates together with:
- CVE-2023-28260: .NET DLL Hijacking Distant Code Execution Vulnerability. This safety patch has been up to date to assist PowerShell 7.2/7.3.
- CVE-2023-21722, CVE-2023-21808: .NET Framework Denial of Service Vulnerability. Microsoft has re-released KB5022498 to deal with a identified difficulty the place prospects who put in the .NET Framework 4.Eight February cumulative replace (KB5022502), then upgraded to .NET Framework 4.8.1 and subsequently scanned for updates, have been unable to put in KB5022498. Clients who have been unable to put in KB5022498 ought to rescan for updates and set up the replace. Clients who’ve already efficiently put in KB5022498 don’t have to take any additional motion.
- CVE-2023-23413, CVE-2023-24867, CVE-2023-24907, CVE-2023-24909: Microsoft PostScript and PCL6 Class Printer Driver Distant Code Execution Vulnerability. The next adjustments have been made to this CVE report’s description: 1) Added FAQ to clarify how an attacker might exploit this Distant Code Execution vulnerability. 2) Eliminated incorrect CVSS metric FAQs. These are informational adjustments solely.
- CVE-2023-28303: Home windows Snipping Software Info Disclosure Vulnerability. Added an FAQ to clarify tips on how to get the replace from the Microsoft Retailer if automated updates for the shop are disabled. That is an informational change solely.
Mitigations and workarounds
Microsoft has revealed the next vulnerability associated mitigations for this month’s April Patch Tuesday launch cycle:
- CVE-2023-23397: To mitigate in opposition to this Microsoft Outlook elevation of privilege vulnerability, Microsoft recommends, “Directors ought to add customers to the Protected Customers Safety Group, which prevents the usage of NTLM as an authentication mechanism. Performing this mitigation makes troubleshooting simpler than different strategies of disabling NTLM.” The Readiness staff recommends that the TCP port 445 (outbound) is blocked till this vulnerability is addressed by an official Microsoft patch.
Testing steerage
Every month, the staff at Readiness analyzes the newest Patch Tuesday updates from Microsoft and supplies detailed, actionable testing steerage. This steerage relies on assessing a big software portfolio and an in depth evaluation of the Microsoft patches and their potential affect on Home windows desktop platforms and software installations.
Given the big variety of adjustments included on this April patch cycle, I’ve damaged down the testing situations into commonplace and high-risk profiles.
- Check your community connectivity (use the net and Groups) with a VPN and dial-up (PPPoE and SSTP).
- Check your Bluetooth connections. Only for enjoyable, strive printing from Bluetooth. OK, that is not humorous.
- When testing your VPN and IKEv2 and L2TP, be certain that the testing profile features a connectivity test.
- Check out sound/audio over RDP desktop periods.
Excessive threat
Microsoft has made some vital adjustments to how the SQLOLEDB element capabilities. SQLOLEDB is a core Microsoft element that handles SQL to OLE API calls. This isn’t the primary time that this key data-focused element has been patched by Microsoft, with a serious replace simply final September. The Evaluation staff at Readiness extremely recommends an software portfolio scan for all functions (and their dependencies) that embrace references to the Microsoft library SQLOLEDB.DLL. Scanning software packages for ODBC references will elevate quite a lot of “noise” and so the library dependency test is most well-liked on this occasion. As soon as finished, database connectivity exams ought to be carried out, and we suspect (most significantly) that these exams ought to be finished over a VPN or a much less steady web connection.
All these (each commonplace and high-risk) situations would require vital application-level testing earlier than a normal deployment of this month’s replace. Along with the SQL connectivity testing necessities, we additionally recommend the next “smoke” exams to your techniques:
- Check out the Home windows on-screen keyboard (OSK).
- Check booting your Home windows desktop techniques from a RAM disk.
- Check the Home windows logging system (CLFS) with a create/learn/replace/delete take a look at (CRUD).
We additionally should think about the newest replace for Adobe Reader this month, so please embrace a printing take a look at in your deployment effort.
Updates by product household
Every month, we break down the replace cycle into product households (as outlined by Microsoft) with the next primary groupings:
- Browsers (Microsoft IE and Edge)
- Microsoft Home windows (each desktop and server)
- Microsoft Workplace
- Microsoft Trade Server
- Microsoft Improvement platforms (ASP.NET Core, .NET Core and Chakra Core)
- Adobe (retired???, possibly subsequent 12 months)
Browsers
This April patch cycle sees the return of patches to the Microsoft Edge browser platform with simply three updates (CVE-2023-28284, CVE-2023-24935, and CVE-2023-28301), all rated as low by Microsoft. As well as, Microsoft has revealed 14 Chromium Edge browser updates, which ought to have minimal deployment dangers. Add these updates to your commonplace patch launch schedule.
In case you have the time, there’s a nice put up from the Chromium venture group on how they’re bettering the efficiency of all Chromium browsers.
Home windows
This April, Microsoft launched seven important updates and 71 patches rated as Necessary to the Home windows platform that cowl the next key parts (for the important updates):
- Microsoft Message Queuing
- Home windows Layer 2 Tunneling Protocol
- Home windows DHCP Server
Sadly, this month there have been studies of a vulnerability (CVE-2023-28252) exploited within the wild, including to our zero-day rely. Add this replace to your “Patch Now” launch schedule.
Microsoft Workplace
No important updates for the Microsoft Workplace product group this month. Microsoft has supplied 5 updates rated as Necessary to Microsoft Writer and SharePoint addressing spoofing and distant code execution safety vulnerabilities. Add these Workplace updates to your commonplace launch schedule.
Microsoft Trade Server
It’s mentioned that April is the cruellest month, however I’m not so positive, as there are not any updates from Microsoft for the Microsoft Trade Server product group this month. This could put some spring in your step.
Microsoft improvement platforms
Microsoft has launched simply six updates to Visible Studio and .NET (6.X/7.x) for this April patch cycle. These patches deal with vulnerabilities with low or vital scores by Microsoft and subsequently will be added to your commonplace developer launch schedule.
Adobe Reader (the cat has come again)
We now have Adobe Reader updates for this April replace cycle. I actually thought that we have been finished with Reader updates, however right here we’re with a Precedence 3 (the bottom score from Adobe) replace (APSB 23-24) that impacts all variations of Adobe Reader and addresses a number of reminiscence leak safety vulnerabilities. Add this replace to your commonplace third-party software deployment effort.
