Microsoft September 2023 Patch Tuesday fixes 2 zero-days, 59 flaws

Today is Microsoft's September 2023 Patch Tuesday, with security updates for 59 flaws, including two actively exploited zero-day vulnerabilities.

While twenty-four RCE bugs were fixed, Microsoft only rated five as 'Critical' — four remote code execution flaws and Azure Kubernetes Service elevation of privilege vulnerability.

The number of bugs in each vulnerability category is listed below:

• 3 Security Feature Bypass Vulnerabilities
• 24 Remote Code Execution Vulnerabilities
• 9 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 5 Spoofing Vulnerabilities
• 5 Edge - Chromium Vulnerabilities

The total count of 59 flaws does not include five Microsoft Edge (Chromium) vulnerabilities two non-Microsoft flaws in Electron and Autodesk.

To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5030219 cumulative update and Windows 10 KB5030211 updates released.

Two actively exploited zero-day vulnerabilities

This month's Patch Tuesday fixes two zero-day vulnerabilities, with both exploited in attacks and one of them publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The two actively exploited zero-day vulnerabilities in today's updates are:

CVE-2023-36802 - Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

Microsoft has fixed an actively exploited local privilege elevation vulnerability that allows attackers to gain SYSTEM privileges.

The flaw was discovered by Quan Jin(@jq0904) & ze0r with DBAPPSecurity WeBin Lab, Valentina Palmiotti with IBM X-Force, Microsoft Threat Intelligence, and Microsoft Security Response Center.

CVE-2023-36761 - Microsoft Word Information Disclosure Vulnerability

Microsoft has fixed an actively exploited vulnerability that can be used to steal NTLM hashes when opening a document, including in the preview pane.

These NTLM hashes can be cracked or used in NTLM Relay attacks to gain access to the account.

This flaw was discovered internally by the Microsoft Threat Intelligence group.

Recent updates from other companies

Other vendors who released updates or advisories in September 2023 include:

• Apple fixed a new zero-day exploit chain called BLASTPASS that was used in attacks to install the Pegasus spyware.
• Atlas VPN to fix a zero-day in the Linux client that can expose the user's actual IP address.
• Asus fixed three critical remote code execution bugs in the SUS RT-AX55, RT-AX56U_V2, and RT-AC86U routers.
• Cisco released security updates for various products and warned of a zero-day in Cisco ASA devices.
• Google released the Android September 2023 and Chrome updates to fix actively exploited vulnerabilities.
• MSI released BIOS updates to fix 'UNSUPPORTED_PROCESSOR' errors in Windows.
• Notepad++ 8.5.7 was released to fix four security vulnerabilities.
• SAP has released its September 2023 Patch Day updates.
• VMware fixed a VMware Tools vulnerability.

The September 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the September 2023 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.