Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 131 vulnerabilities that were fixed in 18 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 18 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Cumulative Security Update (KB5028167) for July 2023

  Severity

  Serious 3

  Qualys ID

  100418

  Vendor Reference

  KB5028167

  CVE Reference

  CVE-2023-32046, CVE-2023-35308, CVE-2023-35336

  CVSS Scores

  Base 7.2 / Temporal 6

  Description

  Internet Explorer is a web browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

  Microsoft has released KB501148 for Internet Explorer 11 and 9

  Affected Versions:
  Internet Explorer 11 on Windows Server 2012 R2, Windows Server 2008 R2
  Internet Explorer 9 on Windows Server 2008

  Consequence

  Successful exploitation allows attacker to gain elevated privileges or could cause a user to access a URL in a less restricted Internet Security Zone than intended.

  Solution

  For more information, Customers are advised to refer the KB5028167

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  5028167

• Microsoft SharePoint Server Update for July 2023

  Severity

  Critical 4

  Qualys ID

  110440

  Vendor Reference

  KB5002423, KB5002424, KB5002425

  CVE Reference

  CVE-2023-33134, CVE-2023-33157, CVE-2023-33159, CVE-2023-33160, CVE-2023-33165

  CVSS Scores

  Base 8.5 / Temporal 6.3

  Description

  Microsoft has released June 2023 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:

  KB5002424
  KB5002423
  KB5002425

  QID Detection Logic (Authenticated):
  Operating System: Windows
  The detection extracts the Install Path for Microsoft Sharepoint via the Windows Registry. Below is the mapping of the Filename, patched version, and KB details checked for each applicable Product: PJINTL.DLL - 16.0.16130.20642 (KB5002424)
  ONETUTIL.DLL - 16.0.10400.20008 (KB5002423)
  ONETUTIL.DLL - 16.0.5404.1000 (KB5002425)

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  June 2023

• Microsoft Office Security Update for July 2023

  Severity

  Critical 4

  Qualys ID

  110441

  Vendor Reference

  KB4493154, KB5001952, KB5002058, KB5002069, KB5002400, KB5002406, KB5002411, KB5002419, KB5002421, KB5002426, KB5002434

  CVE Reference

  CVE-2023-33148, CVE-2023-33149, CVE-2023-33150, CVE-2023-33152, CVE-2023-33158, CVE-2023-33161, CVE-2023-33162

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Microsoft has released July 2023 security updates to fix multiple security vulnerabilities.

  This security update contains the following:

  Office Click-2-Run and Office 365 Release Notes
  Release notes for Office for Mac
  KB5002406
  KB5002411
  KB5002421
  KB5002058
  KB5002419
  KB4493154
  KB5002069
  KB5002400
  KB5001952
  KB5002426
  KB5002434
  QID Detection Logic (Authenticated):
  Operating System: Windows
  The detection extracts the Install Path for Microsoft Office via the Windows Registry. The QID checks the file version of "graph.exe" to identify vulnerable versions of Microsoft Office. Patched Versions for Microsoft 365 Apps for enterprise, Microsoft 365 Apps for business, Office 2016 Retail (C2R), Office 2019, Office Current Channel: Version 2306 (16.0.16529.20182) Monthly Enterprise Channel: Version 2305 (16.0.16501.20242).
  Monthly Enterprise Channel: Version 2304 (16.0.16327.20348).
  Semi-Annual Enterprise Channel (Preview): Version 2302 (16.0.16130.20644).
  Semi-Annual Enterprise Channel: Version 2302 (16.0.16130.20644).
  Semi-Annual Enterprise Channel: Version 2208 (16.0.15601.20706).
  Semi-Annual Enterprise Channel: Version 2202 (16.0.14931.21040).
  Office 2021 Retail: Version 2306 (16.0.16529.20182).
  Office 2019 Retail: Version 2306 (16.0.16529.20182).
  Office 2016 Retail: Version 2306 (16.0.16529.20182).
  Office LTSC 2021 Volume Licensed: Version 2108 (16.0.14332.20529).
  Office 2019 Volume Licensed: Version 1808 (16.0.10400.20007).
  KB5002406 - 16.0.5404.1000 (Excel.exe)
  KB5002058 - 16.0.5404.1000 (Excel.exe)
  KB5002419 - 16.0.5404.1000 (mso.dll)
  KB4493154 - 16.0.5404.1000 (igx.dll)
  KB5002411 - 15.0.5571.1000 (winword.exe)
  KB5002434 - 15.0.5571.1000 (excel.exe)BR KB5002069 - 15.0.5571.1000 (msrtedit.dll)

  Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Office Click-2-Run and Office 365 Release Notes
  Release notes for Office for Mac
  KB5002416
  KB5002406
  KB5002411
  KB5002421
  KB5002058
  KB5002419
  KB4493154
  KB5002069
  KB5002400
  KB5001952
  KB5002426
  KB5002434
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft office July 2023

• Microsoft Outlook Multiple Vulnerabilities Security Update for July 2023

  Severity

  Critical 4

  Qualys ID

  110442

  Vendor Reference

  KB4464506, KB4475581, KB5002427, KB5002432

  CVE Reference

  CVE-2023-33151, CVE-2023-33153, CVE-2023-35311

  CVSS Scores

  Base 7.5 / Temporal 5.9

  Description

  Microsoft has released July 2023 security updates to fix multiple security vulnerabilities.

  This security update contains the following:

  Office Click-2-Run and Office 365 Release Notes
  KB5002427
  KB5002432
  KB4475581
  KB4464506

  QID Detection Logic (Authenticated):
  Operating System: Windows
  The detection extracts the Install Path for Microsoft Office via the Windows Registry. The QID checks the file version of "graph.exe" to identify vulnerable versions of Microsoft Office. Patched Versions for Microsoft 365 Apps for enterprise, Microsoft 365 Apps for business, Office 2016 Retail (C2R), Office 2019, Office Current Channel: Version 2306 (16.0.16529.20182) Monthly Enterprise Channel: Version 2305 (16.0.16501.20242).
  Monthly Enterprise Channel: Version 2304 (16.0.16327.20348).
  Semi-Annual Enterprise Channel (Preview): Version 2302 (16.0.16130.20644).
  Semi-Annual Enterprise Channel: Version 2302 (16.0.16130.20644).
  Semi-Annual Enterprise Channel: Version 2208 (16.0.15601.20706).
  Semi-Annual Enterprise Channel: Version 2202 (16.0.14931.21040).
  Office 2021 Retail: Version 2306 (16.0.16529.20182).
  Office 2019 Retail: Version 2306 (16.0.16529.20182).
  Office 2016 Retail: Version 2306 (16.0.16529.20182).
  Office LTSC 2021 Volume Licensed: Version 2108 (16.0.14332.20529).
  Office 2019 Volume Licensed: Version 1808 (16.0.10400.20007).
  For traditional MSI Installations, following KBs and version are the required:
  KB5002432 - 15.0.5571.1000(outlook.exe)
  KB5002427 - 16.0.5404.1000(outlook.exe)
  KB4475581 - 16.0.5404.1000 (umoutlookaddin.dll).
  KB4464506 - 15.0.5571.1000(umoutlookaddin.dll).

  Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.

  Consequence

  Successful exploitation will lead to spoofing and Security Feature Bypass.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Office Click-2-Run and Office 365 Release Notes
  KB5002427
  KB5002432
  KB4475581
  KB4464506

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  July 2023

• Microsoft Visual Studio Code Security Update for July 2023

  Severity

  Critical 4

  Qualys ID

  378659

  Vendor Reference

  CVE-2023-36867

  CVE Reference

  CVE-2023-36867

  CVSS Scores

  Base 4.3 / Temporal 3.2

  Description

  Visual Studio Code is a lightweight but powerful source code editor which runs on your desktop and is available for Windows, macOS and Linux.

  Affected Versions:
  Visual Studio Code - GitHub Pull Requests and Issues Extension prior to 0.66.2

  QID Detection Logic(Authenticated):
  This QID checks for the vulnerable versions of Visual Studio Code.
  

  Consequence

  Visual Studio Code is prone to Remote Code Execution Vulnerability
  

  Solution

  Customers are advised to refer to CVE-2023-36867 for more information pertaining to this vulnerability.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-36867

• Azure Service Fabric Information Disclosure Vulnerability

  Severity

  Serious 3

  Qualys ID

  378660

  Vendor Reference

  Azure Service Fabric Security Advisory

  CVE Reference

  CVE-2023-36868

  CVSS Scores

  Base 3.3 / Temporal 2.4

  Description

  Azure Service Fabric is Microsoft's platform-as-a-service (PaaS) and a container orchestrator solution used to build and deploy microservices-based cloud applications across a cluster of machines.

  Azure Service Fabric on Windows vulnerable to Information Disclosure Vulnerability

  Affected Versions:
  Azure Service Fabric 9.1 for Windows prior to 9.1.1799.9590
  Azure Service Fabric 9.0 for Windows prior to 9.0.1527.9590

  QID Detection Logic:
  This authenticated checks for SFX installed versions and flags if found vulnerable

  Consequence

  Successful exploitation of this vulnerability may disclose uninitialized memory type of information to an attacker.

  Solution

  Customers are advised to refer to Azure Service Fabric Security Advisory for updates pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Azure Service Fabric Security Advisory

• Mono Authenticode Validation Spoofing Vulnerability

  Severity

  Serious 3

  Qualys ID

  378661

  Vendor Reference

  Mono Security Advisory

  CVE Reference

  CVE-2023-35373

  CVSS Scores

  Base 2.1 / Temporal 1.6

  Description

  Mono is a software platform designed to allow developers to easily create cross platform applications. It is an open source implementation of Microsoft's .NET Framework based on the ECMA standards for C# and the Common Language Runtime.

  Affected Versions:
  Mono versions prior to 6.12.0.200

  QID Detection Logic (Authenticated):
  Windows: Checks for installed vulnerable version of Mono using registry "HKLM\SOFTWARE\Mono".
  Mac: Checks for installed vulnerable version of Mono using command "mono -V".

  Consequence

  Successful exploitation of this vulnerability may affect the confidentiality of the targeted user.

  Solution

  Customers are advised to refer to Mono Security Advisory for updates pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Mono Security Advisory

• Microsoft Raw Image Extension and VP9 Video Extension Information Disclosure Vulnerability

  Severity

  Serious 3

  Qualys ID

  92030

  Vendor Reference

  CVE-2023-32051, CVE-2023-36872

  CVE Reference

  CVE-2023-32051, CVE-2023-36872

  CVSS Scores

  Base 2.1 / Temporal 1.6

  Description

  Microsoft has disclosed Information Disclosure Vulnerability in Windows VP9 Video Extensions.

  Affected Product:
  Raw Image Extension Win10 Version 21H2 and 22H2 , Win11 Version 21H2 prior to 2.0.61662.0
  Raw Image Extension Win11 Version 22H2 prior to 2.1.61661.0
  VP9 Video Extensions prior to 1.0.61591.0
  QID detection Logic:
  The detection gets the version of VP9VideoExtension by querying wmi class Win32_InstalledStoreProgram.

  Consequence

  An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory..

  Solution

  Users are advised to check CVE-2023-36872,CVE-2023-32051for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-32051
  CVE-2023-36872

• Windows Admin Center Spoofing Vulnerability - July 2023

  Severity

  Critical 4

  Qualys ID

  92031

  Vendor Reference

  Windows Admin Center Security Advisory

  CVE Reference

  CVE-2023-29347

  CVSS Scores

  Base 5.5 / Temporal 4.1

  Description

  Windows Admin Center is a customer-deployed, browser-based app for managing servers, clusters, hyper-converged infrastructure, and Windows 10 PCs.

  Windows Admin Center is prone to Spoofing Vulnerability.
  Affected Products:
  Windows Admin Center version prior to 1.5.2306.14001

  QID Detection Logic (authenticated):
  Windows: Checks for installed vulnerable version either from SmeDesktop.exe or sme.exe

  Consequence

  Successful exploitation of this vulnerability may affect Integrity and Availability.

  Solution

  Customers are advised to refer Windows Admin Center Security Advisory for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Windows Admin Center Security Advisory

• Microsoft Paint 3D Remote Code Execution (RCE) Vulnerability for July 2023

  Severity

  Critical 4

  Qualys ID

  92032

  Vendor Reference

  CVE-2023-32047, CVE-2023-35374

  CVE Reference

  CVE-2023-32047, CVE-2023-35374

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Microsoft Paint 3D is prone to Remote Code Execution Vulnerability.

  Affected Product:
  Microsoft Paint 3D prior to 6.2305.16087.0
  QID Detection Logic (Authenticated):
  The detection gets the version of Microsoft.MSPaint by querying wmi class Win32_InstalledStoreProgram.

  Consequence

  Successful exploitation of the vulnerability may allow remote code execution leading to complete system compromise.
  

  Solution

  Users are advised to refer to CVE-2023-32047 CVE-2023-35374 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-32047
  CVE-2023-35374

• Microsoft Windows Security Update for July 2023

  Severity

  Critical 4

  Qualys ID

  92033

  Vendor Reference

  KB5028166, KB5028168, KB5028169, KB5028171, KB5028182, KB5028185, KB5028186, KB5028222, KB5028223, KB5028224, KB5028226, KB5028228, KB5028232, KB5028233, KB5028240

  CVE Reference

  CVE-2023-21526, CVE-2023-21756, CVE-2023-29347, CVE-2023-32033, CVE-2023-32034, CVE-2023-32035, CVE-2023-32037, CVE-2023-32038, CVE-2023-32039, CVE-2023-32040, CVE-2023-32041, CVE-2023-32042, CVE-2023-32043, CVE-2023-32044, CVE-2023-32045, CVE-2023-32046, CVE-2023-32049, CVE-2023-32050, CVE-2023-32053, CVE-2023-32054, CVE-2023-32055, CVE-2023-32056, CVE-2023-32057, CVE-2023-32083, CVE-2023-32084, CVE-2023-32085, CVE-2023-33154, CVE-2023-33155, CVE-2023-33163, CVE-2023-33164, CVE-2023-33166, CVE-2023-33167, CVE-2023-33168, CVE-2023-33169, CVE-2023-33172, CVE-2023-33173, CVE-2023-33174, CVE-2023-35296, CVE-2023-35297, CVE-2023-35298, CVE-2023-35299, CVE-2023-35300, CVE-2023-35302, CVE-2023-35303, CVE-2023-35304, CVE-2023-35305, CVE-2023-35306, CVE-2023-35308, CVE-2023-35309, CVE-2023-35312, CVE-2023-35313, CVE-2023-35314, CVE-2023-35315, CVE-2023-35316, CVE-2023-35317, CVE-2023-35318, CVE-2023-35319, CVE-2023-35320, CVE-2023-35321, CVE-2023-35322, CVE-2023-35323, CVE-2023-35324, CVE-2023-35325, CVE-2023-35326, CVE-2023-35328, CVE-2023-35329, CVE-2023-35330, CVE-2023-35331, CVE-2023-35332, CVE-2023-35336, CVE-2023-35337, CVE-2023-35338, CVE-2023-35339, CVE-2023-35340, CVE-2023-35341, CVE-2023-35342, CVE-2023-35343, CVE-2023-35347, CVE-2023-35348, CVE-2023-35350, CVE-2023-35351, CVE-2023-35352, CVE-2023-35353, CVE-2023-35356, CVE-2023-35357, CVE-2023-35358, CVE-2023-35360, CVE-2023-35361, CVE-2023-35362, CVE-2023-35363, CVE-2023-35364, CVE-2023-35365, CVE-2023-35366, CVE-2023-36871, CVE-2023-36874

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Microsoft Windows Security Update - July 2023

  The KB Articles associated with the update:
  The patch version for KB50282286.3.9600.21074
  The patch version for KB50282236.3.9600.21074
  The patch version for KB50282226.0.6003.22174
  The patch version for KB50282266.0.6003.22174
  The patch version for KB502816910.0.14393.6085
  The patch version for KB502816810.0.17763.4644
  The patch version for KB502817110.0.20348.1850
  The patch version for KB502818610.0.10240.20048
  The patch version for KB502816610.0.19041.3208
  The patch version for KB502818510.0.22621.1992
  The patch version for KB502818210.0.22000.2176
  The patch version for KB50282326.2.9200.24374
  The patch version for KB50282336.2.9200.24374
  The patch version for KB50282406.1.7601.26623
  The patch version for KB50282246.1.7601.26623

  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of 'ntoskrnl.exe'.

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Please refer to the following KB Articles associated with the update:
  KB5028228
  KB5028223
  KB5028222
  KB5028226
  KB5028169
  KB5028168
  KB5028171
  KB5028186
  KB5028166
  KB5028185
  KB5028182
  KB5028232
  KB5028233
  KB5028240
  KB5028224
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5028166
  KB5028168
  KB5028169
  KB5028171
  KB5028182
  KB5028185
  KB5028186
  KB5028222
  KB5028223
  KB5028224
  KB5028226
  KB5028228
  KB5028232
  KB5028233
  KB5028240

• Microsoft Visual Studio Security Updates for July 2023

  Severity

  Critical 4

  Qualys ID

  92034

  Vendor Reference

  CVE-2023-33127, CVE-2023-33170, CVE-2023-35333, CVE-2023-35373

  CVE Reference

  CVE-2023-33127, CVE-2023-33170, CVE-2023-35333, CVE-2023-35373

  CVSS Scores

  Base 9 / Temporal 7

  Description

  Microsoft has released security Updates for Visual Studio which resolve Security Feature Bypass and Escalation of Privileges Vulnerabilities.

  Affected Software:
  Microsoft Visual Studio 2022 version 17.6
  Microsoft Visual Studio 2022 version 17.4
  Microsoft Visual Studio 2022 version 17.2
  Microsoft Visual Studio 2022 version 17.0
  

  QID Detection Logic: Authenticated : Windows
  This QID detects vulnerable versions of Microsoft Visual Studio by checking the registry key "HKLM\SOFTWARE\Microsoft" and file "evenv.exe" to check the version of the Visual Studio.
  

  Consequence

  Vulnerable versions of Microsoft Visual Studio are prone to Security Feature Bypass and Escalation of Privileges Vulnerabilities.

  Solution

  Customers are advised to refer to CVE-2023-33127, CVE-2023-33170, CVE-2023-35373, and CVE-2023-35333 for more information on these vulnerabilities and their patches.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-33127
  CVE-2023-33170
  CVE-2023-35333
  CVE-2023-35373

• Microsoft Dynamics 365 Security Update for July 2023

  Severity

  Urgent 5

  Qualys ID

  92035

  Vendor Reference

  CVE-2023-33171, CVE-2023-35335, CVE-2023-36416

  CVE Reference

  CVE-2023-33171, CVE-2023-35335, CVE-2023-35389, CVE-2023-36416

  CVSS Scores

  Base 6.5 / Temporal 4.8

  Description

  Microsoft Dynamics 365 is a product line of enterprise resource planning and customer relationship management intelligent business applications.

  Affected Software:
  Microsoft Dynamics 365 (on-premises) prior to 9.0.47.8

  Microsoft Dynamics 365 (on-premises) prior to 9.1.18.22

  QID Detection Logic(Authenticated):
  This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file Microsoft.Crm.Setup.Server.exe:
  

  Consequence

  Successful exploitation of this vulnerability could lead to a Cross-site Scripting Vulnerability

  Solution

  Customers are advised to refer to CVE-2023-35335 and CVE-2023-33171 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-33171
  CVE-2023-35335

• Microsoft .NET Security Update for July 2023

  Severity

  Critical 4

  Qualys ID

  92036

  Vendor Reference

  CVE-2023-33127, CVE-2023-33170

  CVE Reference

  CVE-2023-33127, CVE-2023-33170

  CVSS Scores

  Base 7.6 / Temporal 6

  Description

  Microsoft has released a security Update for .NET which resolves Security Feature Bypass and Escalation of Privileges Vulnerabilities.

  Affected versions:
  .NET 6.0 before version 6.0.20
  .NET 7.0 before version 7.0.9
  

  QID Detection Logic: Authenticated
  On Windows, this QID detects vulnerable versions of Microsoft .NET by checking the file version.
  On Linux, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" and "/root/shared/Microsoft.NETCore.App" folders.
  On Mac, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" folder.
  

  Consequence

  Vulnerable versions of Microsoft Visual Studio are prone to Security Feature Bypass and Escalation of Privileges Vulnerabilities.

  Solution

  Customers are advised to refer to CVE-2023-33127 andCVE-2023-33170 for more information on these vulnerabilities and their patches.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-33127
  CVE-2023-33170

• Microsoft Windows Domain Name System (DNS) Server Remote Code Execution (RCE) Vulnerability July 2023

  Severity

  Critical 4

  Qualys ID

  92037

  Vendor Reference

  KB5028168, KB5028169, KB5028171, KB5028222, KB5028223, KB5028224, KB5028226, KB5028228, KB5028232, KB5028233, KB5028240

  CVE Reference

  CVE-2023-35310, CVE-2023-35344, CVE-2023-35345, CVE-2023-35346

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Microsoft Windows Domain Name System (DNS) Server Security Update - July 2023

  Operating Systems: Windows Server 2008, Windows Server 2012, Windows Server 2022, Windows Server 2019, Windows Server 2016

  The KB Articles associated with the update:
  The patch version for KB5028222
  The patch version for KB5028226
  The patch version for KB5028169
  The patch version for KB5028171
  The patch version for KB5028168
  The patch version for KB5028228
  The patch version for KB5028223
  The patch version for KB5028232
  The patch version for KB5028233
  The patch version for KB5028240
  The patch version for KB5028224
  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of dns.exe

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Vendor has released patch. Please refer to
  The patch version for KB5028222
  The patch version for KB5028226
  The patch version for KB5028169
  The patch version for KB5028171
  The patch version for KB5028168
  The patch version for KB5028228
  The patch version for KB5028223
  The patch version for KB5028232
  The patch version for KB5028233
  The patch version for KB5028240
  The patch version for KB5028224
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5028168
  KB5028169
  KB5028171
  KB5028222
  KB5028223
  KB5028224
  KB5028226
  KB5028228
  KB5028232
  KB5028233
  KB5028240

• Microsoft Windows Search Remote Code Execution (RCE) Vulnerability

  Severity

  Critical 4

  Qualys ID

  92038

  Vendor Reference

  CVE-2023-36884

  CVE Reference

  CVE-2023-36884

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Microsoft released updates to fix Windows Search remote code execution vulnerability.

  The patch version is 6.3.9600.21501 for 5029312
  The patch version is 6.3.9600.21501 for 5029304
  The patch version is 6.2.9200.24412 for 5029295
  The patch version is 6.2.9200.24412 for 5029308
  The patch version is 6.1.7601.26662 for 5029296
  The patch version is 6.1.7601.26662 for 5029307
  The patch version is 6.0.6003.22214 for 5029318
  The patch version is 6.0.6003.22214 for 5029301
  The patch version is 10.0.14393.6167 for 5029242
  The patch version is 10.0.10240.20107 for 5029259
  The patch version is 10.0.19041.3324 for 5029244
  The patch version is 10.0.22621.2134 for 5029263
  The patch version is 10.0.22000.2295 for 5029253
  The patch version is 10.0.20348.1906 for 5029250
  The patch version is 10.0.17763.4737 for 5029247

  QID Detection Logic (Authenticated):
  

  This QID checks for the file version of 'ntoskrnl.exe'.

  Consequence

  Successful exploitation allows attacker to send the targeted user a specially crafted file that is designed to exploit the remote code execution vulnerability.

  Solution

  Please refer to the following KB Articles associated with the update:
  5029312
  5029304
  5029295
  5029308
  5029296
  5029307
  5029318
  5029301
  5029242
  5029259
  5029244
  5029263
  5029253
  5029250
  5029247
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5029242
  KB5029244
  KB5029247
  KB5029250
  KB5029253
  KB5029259
  KB5029263
  KB5029295
  KB5029296
  KB5029301
  KB5029304
  KB5029307
  KB5029308
  KB5029312
  KB5029318

• Microsoft Defender Elevation of Privilege Vulnerability for July 2023

  Severity

  Critical 4

  Qualys ID

  92039

  Vendor Reference

  CVE-2023-33156

  CVE Reference

  CVE-2023-33156

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.

  Affected Versions / Software:
  Microsoft Malware Protection Engine version prior to Version 1.1.23050.3 QID Detection Logic (Authenticated):
  The authenticated check looks for the version of "mpengine.dll" file.

  Consequence

  Successful exploitation of this vulnerability requires an attacker to win a race condition.

  Solution

  Users are advised to check CVE-2023-33156 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-33156

• Microsoft Windows Routing and Remote Access Service (RRAS) Remote Code Execution (RCE) Vulnerability for July 2023

  Severity

  Critical 4

  Qualys ID

  92040

  Vendor Reference

  CVE-2023-35367

  CVE Reference

  CVE-2023-35367

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  Microsoft released an update to fix remote code execution vulnerability in Routing and Remote Access Service.

  QID Detection Logic (Authenticated):
  

  This QID checks for the "Routing and Remote Access" service is running and then check for file version of 'ntoskrnl.exe'.

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Please refer to the following KB Articles associated with the update:
  KB5028228
  KB5028223
  KB5028222
  KB5028226
  KB5028169
  KB5028168
  KB5028171
  KB5028186
  KB5028166
  KB5028185
  KB5028182
  KB5028232
  KB5028233
  KB5028240
  KB5028224
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-35367

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.