Microsoft addressed 97 present vulnerabilities this Tuesday with patches in April, with eight extra beforehand issued patches up to date and reissued. There are reviews of a vulnerability (CVE-2023-28252) being exploited within the wild, making it a “Patch Now” model.
This replace cycle impacts Home windows desktops, Microsoft Workplace, and Adobe Reader. There aren’t any updates for Microsoft Change this month. The Software Readiness crew has offered a useful infographic that outlines the dangers related to every of the updates for this April replace cycle.
Already identified points
Every month, Microsoft features a record of identified points that apply to the working system and platforms which are included in that replace cycle.
- Home windows 11 22H2: After putting in this or later updates, Home windows units with some third-party UI customization functions could not begin. Microsoft is at present investigating this challenge.
- Updates launched on or after February 14, 2023 might not be accessible from some Home windows Server Replace Companies (WSUS) servers for Home windows 11, model 22H2. Updates can be downloaded to the WSUS server, however might not be additional distributed to consumer units. Microsoft is engaged on this challenge. An replace is anticipated quickly.
And for these gaming cowboys, it appears like Pink Lifeless Redemption 2 is useless on arrival a minimum of for this April replace. For these IT admins copying giant recordsdata to Home windows 11 techniques (we all know who you’re), you will simply have to attend (a bit of longer) as there’s nonetheless a buffering challenge for multi-gigabit community transfers on the newest desktop working system Microsoft.
Main revisions
This month, Microsoft launched a number of main revisions for earlier updates, together with:
- CVE-2023-28260: .NET DLL distant code execution vulnerability. This safety patch has been up to date to help PowerShell 7.2/7.3.
- CVE-2023-21722, CVE-2023-21808: .NET Framework denial of service vulnerability. Microsoft reissued KB5022498 to deal with a identified challenge the place prospects who put in the .NET Framework 4.8 February Cumulative Replace (KB5022502), then upgraded to the .NET Framework 4.8.1 and subsequently scanned for updates failed to put in KB5022498. Clients who failed to put in KB5022498 ought to rescan for updates and set up the replace. Clients who’ve already efficiently put in KB5022498 don’t have to take any additional motion.
- CVE-2023-23413, CVE-2023-24867, CVE-2023-24907, CVE-2023-24909: Microsoft PostScript and PCL6 Class Printer Driver Distant Code Execution Vulnerability. The next adjustments have been made to this description of the CVE reviews: 1) Added a FAQ to clarify how an attacker may exploit this distant code execution vulnerability. 2) Eliminated FAQ about incorrect metrics for CVSS. These are informational adjustments solely.
- CVE-2023-28303: Home windows Snipping Software Info Disclosure Vulnerability. Added a FAQ to clarify get the replace from the Microsoft Retailer if automated updates for the shop are disabled. That is an informational change solely.
Mitigation and workarounds
Microsoft printed the next vulnerability mitigations for the April Patch Tuesday launch cycle this month:
- CVE-2023-23397: To mitigate this Microsoft Outlook elevation of privilege vulnerability, Microsoft recommends: “Directors ought to add customers to the Protected Customers safety group, which prevents using NTLM as an authentication mechanism. Implementing this mitigation makes troubleshooting simpler than different strategies of disabling NTLM.” The Readiness Workforce recommends that TCP port 445 (outbound) be blocked till this vulnerability is addressed by an official Microsoft patch.
Testing Pointers
Every month, the Readiness crew analyzes the newest updates from Microsoft on Tuesday and supplies detailed, actionable testing steering. This information is predicated on an analysis of a big portfolio of functions and an in depth evaluation of Microsoft’s fixes and their potential influence on Home windows desktop platforms and software installations.
Given the big variety of adjustments included on this April patch cycle, I’ve divided the take a look at eventualities into commonplace and high-risk profiles.
- Check your community connectivity (use internet and Groups) with VPN and dial-up (PPPoE and SSTP).
- Check your Bluetooth connections. Only for enjoyable, attempt printing from Bluetooth. Okay, that is not humorous.
- When testing your VPN and IKEv2 and L2TP, ensure that the take a look at profile features a connectivity verify.
- Check sound/audio over RDP desktop classes.
Excessive threat
Microsoft has made some important adjustments to the performance of the SQLOLEDB part. SQLOLEDB is a core Microsoft part that handles SQL to OLE API calls. This is not the primary time this key data-focused part has been tweaked by Microsoft, with a serious replace simply final September. The Readiness Evaluation Workforce strongly recommends an Software Portfolio scan for all functions (and their dependencies) that embody references to the Microsoft SQLOLEDB.DLL library. Scanning software packages for ODBC references will elevate a number of “noise”, so library dependency checking is preferable on this case. As soon as performed, database connectivity checks needs to be carried out, and we suspect (most significantly) that these checks needs to be performed over a VPN or much less steady web connection.
All of those (each commonplace and high-risk) eventualities would require important application-level testing earlier than basic deployment of this month’s replace. Along with the SQL connectivity testing necessities, we additionally provide the next “smoke” checks on your techniques:
- Check the Home windows On-Display screen Keyboard (OSK).
- Check booting your desktop Home windows techniques from a RAM disk.
- Check the Home windows logging system (CLFS) with a create/learn/replace/delete (CRUD) take a look at.
We additionally want to think about the newest replace for Adobe Reader this month, so please embody a print take a look at in your deployment efforts.
Updates by product household
Every month, we divide the replace cycle of product households (as outlined by Microsoft) into the next most important teams:
- Browsers (Microsoft IE and Edge)
- Microsoft Home windows (Desktop and Server)
- Microsoft Workplace
- Microsoft Change Server
- Microsoft Improvement Platforms (ASP.NET Core, .NET Core, and Chakra Core)
- Adobe (retired???, possibly subsequent yr)
Browsers
This April patch cycle sees the return of fixes to the Microsoft Edge browser platform with solely three updates (CVE-2023-28284, CVE-2023-24935, and CVE-2023-28301), all rated as low by Microsoft. Moreover, Microsoft has launched 14 updates to the Chromium Edge browser, which ought to have minimal deployment dangers. Add these updates to your commonplace patch launch schedule.
You probably have time, there’s an incredible publish from the Chromium Undertaking crew on how they’re enhancing the efficiency of all Chromium browsers.
Home windows
This April, Microsoft launched seven essential updates and 71 fixes rated as necessary for the Home windows platform, which cowl the next key parts (for the essential updates):
- Microsoft Message Queuing
- Home windows Layer 2 Tunneling Protocol
- Home windows DHCP server
Sadly, this month there have been reviews of a vulnerability (CVE-2023-28252) being exploited within the wild, including to our variety of zero days. Add this replace to your Patch Now launch schedule.
Microsoft Workplace
There aren’t any essential updates for the Microsoft Workplace product group this month. Microsoft has offered 5 updates rated as necessary for Microsoft Writer and SharePoint that tackle forgery and distant code execution safety vulnerabilities. Add these Workplace updates to your commonplace launch schedule.
Microsoft Change Server
They are saying April is essentially the most brutal month, however I am not so positive since there aren’t any updates from Microsoft for the Microsoft Change Server product group this month. This could put a bit of spring in your step.
Microsoft improvement platforms
Microsoft launched solely six Visible Studio and .NET (6.X/7.x) updates for this April patch cycle. These patches tackle vulnerabilities with low or essential scores from Microsoft and subsequently might be added to your commonplace developer launch schedule.
Adobe Reader (the cat is again)
We’ve Adobe Reader updates for this April replace cycle. I actually thought we have been performed with Reader updates, however right here we’re with a Precedence 3 (Adobe’s lowest ranking) replace (APSB 23-24) that impacts all variations of Adobe Reader and addresses a number of reminiscence leak safety vulnerabilities . Add this replace to your commonplace third-party software deployment efforts.
Copyright © 2023 IDG Communications, Inc.
