Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 71 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Office Security Update for February 2023

  Severity

  Critical 4

  Qualys ID

  110426

  Vendor Reference

  KB5002309, KB5002313, KB5002316, KB5002323

  CVE Reference

  CVE-2023-21714, CVE-2023-21715, CVE-2023-21716, CVE-2023-21721, CVE-2023-21823

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Microsoft has released February 2023 security updates to fix multiple security vulnerabilities.

  This security update contains the following:

  Office Click-2-Run and Office 365 Release Notes
  Release notes for Office for Mac
  KB5002316
  KB5002309
  KB5002313

  QID Detection Logic:
  This authenticated QID checks the file versions from the Microsoft advisory with the versions on the affected office system.

  Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.

  Following keys are used in the detection. HKLM\SOFTWARE\Microsoft\Office.0\Common\InstallRoot\Path HKLM\SOFTWARE\Wow6432Node\Microsoft\Office.0\Common\InstallRoot\Path HKLM\SOFTWARE\Wow6432Node\Microsoft\Office.0\Common\InstallRoot\Path HKLM\SYSTEM\CurrentControlSet\Services\WACSM\ImagePath HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.WacSERVER\InstallLocation HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\InstallationPath HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration\InstallationPath

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Office Click-2-Run and Office 365 Release Notes
  Release notes for Office for Mac
  KB5002316
  KB5002309
  KB5002313

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Office Information Disclosure Vulnerability
  Microsoft OneNote Elevation of Privilege Vulnerability
  Microsoft Publisher Security Features Bypass Vulnerability
  Microsoft Word Remote Code Execution Vulnerability
  Windows Graphics Component Remote Code Execution Vulnerability

• Microsoft SharePoint Server and Foundation Update for February 2023

  Severity

  Critical 4

  Qualys ID

  110427

  Vendor Reference

  KB5002312, KB5002325, KB5002330, KB5002342, KB5002346, KB5002347, KB5002350, KB5002352, KB5002353

  CVE Reference

  CVE-2023-21716, CVE-2023-21717

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Microsoft has released February 2023 security updates to fix multiple security vulnerabilities.

  This security update contains the following KBs:

  KB5002347
  KB5002312
  KB5002353
  KB5002342
  KB5002330
  KB5002346
  KB5002350
  KB5002325
  KB5002352
  QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected SharePoint system.

  Consequence

  Successful exploitation allows an attacker to execute code remotely.

  Solution

  Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  KB5002347
  KB5002312
  KB5002353
  KB5002342
  KB5002330
  KB5002346
  KB5002350
  KB5002325
  KB5002352
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  February 2023

• Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability for February 2023

  Severity

  Critical 4

  Qualys ID

  50125

  Vendor Reference

  CVE-2023-21529, CVE-2023-21706, CVE-2023-21707, CVE-2023-21710

  CVE Reference

  CVE-2023-21529, CVE-2023-21706, CVE-2023-21707, CVE-2023-21710

  CVSS Scores

  Base 8.3 / Temporal 6.5

  Description

  Microsoft Exchange Server 2013, 2016 and 2019 are affected by multiple vulnerabilities.

  KB Articles associated with this update are: KB5023038

  Affected Versions:
  Microsoft Exchange Server 2013 Cumulative Update 23
  Microsoft Exchange Server 2016 Cumulative Update 23
  Microsoft Exchange Server 2019 Cumulative Update 11
  Microsoft Exchange Server 2019 Cumulative Update 12
  

  QID Detection Logic (Authenticated):
  The QID checks for vulnerable version of Microsoft Exchange Server by checking the file version of Exsetup.exe.

  Consequence

  Successful exploitation of the vulnerability may allow remote code execution

  Solution

  Microsoft has released patch, customers are advised to refer to KB5023038 for information pertaining to this vulnerability.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5023038

• Microsoft 3D Builder Remote Code Execution (RCE) Vulnerability for February 2023

  Severity

  Critical 4

  Qualys ID

  91975

  Vendor Reference

  CVE-2023-23377, CVE-2023-23390

  CVE Reference

  CVE-2023-23377, CVE-2023-23390

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  3D Builder is an application to View, Create, and Personalize 3D objects.
  Microsoft has released a security update to 3D Builder Application to address a remote code execution vulnerability.

  Affected Versions:
  3D Builder Version prior to 20.0.3.0

  QID Detection Logic:
  This QID gets the version of 3D Builder by querying wmi class Win32_InstalledStoreProgram.

  Consequence

  An attacker can perform a Remote Code Execution Vulnerability on a vulnerable version of 3D Builder.

  Note: Even though the attack vector is local, Microsoft classified this as a Remote Code Execution Vulnerability because an attacker may exploit this through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.
  

  Solution

  Customers are advised to install latest version of Application from 3D Builder Application.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  3D Builder Application

• Microsoft .NET Framework Security Update for February 2023

  Severity

  Serious 3

  Qualys ID

  91977

  Vendor Reference

  KB5022497, KB5022503, KB5022727, KB5022728, KB5022729, KB5022730, KB5022731, KB5022732, KB5022733, KB5022734, KB5022735, KB5022782, KB5022783, KB5022784, KB5022785, KB5022786, KB5022838, KB5022858

  CVE Reference

  CVE-2023-21722, CVE-2023-21808

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  A Denial of Service and Remote Code Execution Vulnerability exist in Microsoft .Net Framework.

  Following KBs are covered in this detection:
  KB5022838
  KB5022503
  KB5022729
  KB5022732
  KB5022784
  KB5022727
  KB5022782
  KB5022731
  KB5022783
  KB5022858
  KB5022734
  KB5022786
  KB5022497
  KB5022728
  KB5022730
  KB5022735
  KB5022733
  KB5022785
  

  This security update is rated Important for supported versions of Microsoft .NET Framework.

  .NET Framework 2.0, 3.0, 3.5, 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1

  QID Detection Logic (Authenticated):
  Checks for vulnerable file.version of ntoskrnl.exe or Mscorlib.dll or System.core.dll for the respective .Net Framework KBs
  

  Consequence

  Successful exploitation may allow a attacker to perform Denial of Service or Remote Code Execution Vulnerability.
  

  Solution

  Customers are advised to refer to CVE-2023-21722 and CVE-2023-21808 for more details pertaining to these vulnerabilities.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-21722
  CVE-2023-21808

• Microsoft Dynamics Security Update for February 2023

  Severity

  Serious 3

  Qualys ID

  91978

  Vendor Reference

  CVE-2023-21570, CVE-2023-21571, CVE-2023-21572, CVE-2023-21573, CVE-2023-21807

  CVE Reference

  CVE-2023-21570, CVE-2023-21571, CVE-2023-21572, CVE-2023-21573, CVE-2023-21807

  CVSS Scores

  Base 6.4 / Temporal 4.7

  Description

  Microsoft Dynamics contains the following vulnerabilities:
  Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.

  Affected Software:
  Microsoft Dynamics 365 (on-premises) version 9.0
  Microsoft Dynamics 365 (on-premises) version 9.1

  QID Detection Logic:
  This QID detects vulnerable versions by checking if the version of Microsoft.Crm.Setup.Server.exe is lesser than the affected Versions:
  

  Consequence

  Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

  Solution

  Customers are advised to refer to CVE-2023-21573,CVE-2023-21572, CVE-2023-21571, CVE-2023-21570, CVE-2023-21807,for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-21570
  CVE-2023-21571
  CVE-2023-21572
  CVE-2023-21573
  CVE-2023-21807

• Microsoft Windows Security Update for February 2023

  Severity

  Critical 4

  Qualys ID

  91979

  Vendor Reference

  KB5022834, KB5022836, KB5022838, KB5022840, KB5022842, KB5022845, KB5022858, KB5022894, KB5022895, KB5022899, KB5022903

  CVE Reference

  CVE-2023-21684, CVE-2023-21685, CVE-2023-21686, CVE-2023-21687, CVE-2023-21688, CVE-2023-21689, CVE-2023-21690, CVE-2023-21691, CVE-2023-21692, CVE-2023-21693, CVE-2023-21694, CVE-2023-21695, CVE-2023-21697, CVE-2023-21699, CVE-2023-21700, CVE-2023-21701, CVE-2023-21702, CVE-2023-21797, CVE-2023-21798, CVE-2023-21799, CVE-2023-21801, CVE-2023-21802, CVE-2023-21803, CVE-2023-21804, CVE-2023-21805, CVE-2023-21811, CVE-2023-21812, CVE-2023-21813, CVE-2023-21816, CVE-2023-21817, CVE-2023-21818, CVE-2023-21819, CVE-2023-21820, CVE-2023-21822, CVE-2023-21823, CVE-2023-23376

  CVSS Scores

  Base 7.2 / Temporal 6

  Description

  Microsoft Windows Security Update - Feburary 2023

  QID Detection Logic (Authenticated):
  Operating Systems: Windows Server 2012, Windows Server 2016, Windows 10, Windows 11, Windows Server 2022, Windows Server 2019

  The KB Articles associated with the update:
  The patch version is 6.3.9600.20815 for KB5022899
  The patch version is 6.3.9600.20815 for KB5022894
  The patch version is 6.2.9200.24111 for KB5022903
  The patch version is 6.2.9200.24111 for KB5022895
  The patch version is 10.0.14393.5717 for KB5022838
  The patch version is 10.0.10240.19747 for KB5022858
  The patch version is 10.0.19041.2604 for KB5022834
  The patch version is 10.0.22621.1265 for KB5022845
  The patch version is 10.0.22000.1574 for KB5022836
  The patch version is 10.0.20348.1547 for KB5022842
  The patch version is 10.0.17763.4010 for KB5022840
  

  This QID checks for the file version of ntoskrnl.exe.

  Consequence

  Successful exploit could compromise Confidentiality, Integrity and Availability

  Solution

  Please refer to the following KB Articles associated with the update:
  KB5022899
  KB5022894
  KB5022903
  KB5022895
  KB5022838
  KB5022858
  KB5022834
  KB5022845
  KB5022836
  KB5022842
  KB5022840
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5022834
  KB5022835
  KB5022836
  KB5022838
  KB5022840
  KB5022842
  KB5022845
  KB5022858
  KB5022894
  KB5022895
  KB5022899
  KB5022903

• Microsoft Visual Studio Security Updates for February 2023

  Severity

  Critical 4

  Qualys ID

  91980

  Vendor Reference

  CVE-2023-21566, CVE-2023-21567, CVE-2023-21808, CVE-2023-21815, CVE-2023-23381, CVE-2023-41953

  CVE Reference

  CVE-2023-21566, CVE-2023-21567, CVE-2023-21808, CVE-2023-21815, CVE-2023-23381, CVE-2023-41953

  CVSS Scores

  Base 4.6 / Temporal 3.4

  Description

  Microsoft has released security Updates for Visual Studio which resolve Remote Code Execution, Denial of Service and Escalation of Priviledge Vulnerabilities.

  Affected Software:
  Microsoft Visual Studio 2022 version 17.4
  Microsoft Visual Studio 2022 version 17.2
  Microsoft Visual Studio 2022 version 17.0
  Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  

  QID Detection Logic: Authenticated : Windows
  This QID detects vulnerable versions of Microsoft Visual Studio by checking the registry key "HKLM\SOFTWARE\Microsoft" and file "evenv.exe" to check the version of the Visual Studio.
  

  Consequence

  Vulnerable versions of Microsoft Visual Studio are prone to Remote Code Execution, Denial of Service and Escalation of Priviledge Vulnerabilities.
  

  Solution

  Customers are advised to refer to CVE-2023-21815 and CVE-2023-23381 and CVE-2023-21567 and CVE-2023-21566 and CVE-2023-21808 and CVE-2023-41953for more information pertaining to this vulnerability

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-21566
  CVE-2023-21567
  CVE-2023-21808
  CVE-2023-21815
  CVE-2023-23381
  CVE-2023-41953

• Microsoft Dynamics Unified Service Desk Remote Code Execution (RCE) Vulnerability

  Severity

  Critical 4

  Qualys ID

  91981

  Vendor Reference

  CVE-2023-21778

  CVE Reference

  CVE-2023-21778

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Unified Service Desk assists an agent to view the data stored in the Dynamic 365 Customer Engagement app in a holistic manner.
  

  CVE-2023-21778:Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability.
  Affected Software:
  Microsoft Dynamics Unified Service Desk prior to 4.2.0.51.
  QID Detection Logic(Authenticated):
  This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file UnifiedServiceDesk.exe.
  

  Consequence

  The attacker might be able to call victim's local files in the Resources directory and execute Windows commands that are outside of the Dynamics application.

  Solution

  Customers are advised to refer to CVE-2023-21778

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-21778

• Microsoft Power BI Report Server Update for February 2023

  Severity

  Critical 4

  Qualys ID

  91982

  Vendor Reference

  CVE-2023-21806

  CVE Reference

  CVE-2023-21806

  CVSS Scores

  Base 6.4 / Temporal 4.7

  Description

  Power BI Report Server, available as part of Power BI Premium, enables on-premises web and mobile viewing of Power BI reports, plus the enterprise reporting capabilities of SQL Server Reporting Services.

  Affected Versions:
  Power BI Report Server (September 2022) - file version: 15.0.1110.135 Power BI Report Server (September 2022)- file version: 15.0.1110.120 Power BI Report Server (May 2022)- file version: 15.0.1108.297 QID Detection Logic:
  This authenticated QID detects vulnerable versions of RSHostingService.exe by fetching the service installed path from the HKLM\SYSTEM\CurrentControlSet\Services\PowerBIReportServer registry key.

  Consequence

  Successful exploitation can lead to spoofing vulnerability

  Solution

  Customers are advised to refer to CVE-2023-21806 for more information pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-21806

• Microsoft SQL Server Remote Code Execution (RCE) Vulnerability for February 2023

  Severity

  Critical 4

  Qualys ID

  91983

  Vendor Reference

  CVE-2023-21528, CVE-2023-21568, CVE-2023-21704, CVE-2023-21705, CVE-2023-21713, CVE-2023-21718

  CVE Reference

  CVE-2023-21528, CVE-2023-21568, CVE-2023-21704, CVE-2023-21705, CVE-2023-21713, CVE-2023-21718, CVE-2023-23384

  CVSS Scores

  Base 6 / Temporal 4.4

  Description

  Microsoft SQL Server prone to Remote Code Execution Vulnerability. Affected Software:
  SQL Server 2022 RTM (GDR)
  SQL Server 2019 RTM (GDR,CU18)
  SQL Server 2017 RTM (GDR,CU31)
  SQL Server 2016 Service Pack 3(GDR)
  SQL Server 2014 Service Pack 3 (GDR, CU4)
  QID Detection Logic (Authenticated):
  Detection looks for Microsoft SQL Server instances and checks sqlservr.exe file version

  Consequence

  Successful exploitation could lead to remote code execution

  Solution

  Customers are advised to refer to KB5021522 KB5021124 KB5021126 KB5021045 KB5021127 KB5021037 KB5021129 KB5021125 KB5021128 for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5021037
  KB5021045
  KB5021124
  KB5021125
  KB5021126
  KB5021127
  KB5021128
  KB5021129
  KB5021522

• Microsoft Windows Server Privilege Escalation Vulnerability

  Severity

  Critical 4

  Qualys ID

  91984

  Vendor Reference

  KB5022872, KB5022874, KB5022890, KB5022893

  CVE Reference

  CVE-2023-21800

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  Microsoft Windows Server Security Update - Feburary 2023

  QID Detection Logic (Authenticated):
  Operating Systems: Windows Server 2008, Windows Server 2008 R2

  The KB Articles associated with the update:
  The patch version is 6.1.7601.26362 for KB5022872
  The patch version is 6.1.7601.26362 for KB5022874
  The patch version is 6.0.6003.21911 for KB5022890
  The patch version is 6.0.6003.21911 for KB5022893

  This QID checks for the file version of ntoskrnl.exe.

  Consequence

  Successful exploitation of this vulnerability may allow a low privileged attacker to execute code with elevated permissions.

  Solution

  Please refer to the following KB Articles associated with the update:
  KB5022872
  KB5022874
  KB5022890
  KB5022893
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB5022872
  KB5022874
  KB5022890
  KB5022893

• Azure DevOps Server Multiple Vulnerabilities for February 2023

  Severity

  Critical 4

  Qualys ID

  91985

  Vendor Reference

  CVE-2023-21553, CVE-2023-21564

  CVE Reference

  CVE-2023-21553, CVE-2023-21564

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Azure DevOps Server is a Microsoft product that provides version control, reporting, requirements management, project management, automated builds, testing, and release management capabilities.
  CVE-2023-21564: Azure DevOps Server Cross-Site Scripting Vulnerability.
  CVE-2023-21553: Azure DevOps Server Remote Code Execution Vulnerability.

  Affected Software:
  Azure DevOps Server 2022.
  Azure DevOps Server 2020.1.2

  QID Detection Logic(Authenticated):
  This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file Microsoft.TeamFoundation.Framework.Server.dll.
  

  Consequence

  Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

  Solution

  Customers are advised to refer to CVE-2023-21564, CVE-2023-21553, for more details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-21553
  CVE-2023-21564

• Microsoft .NET Security Update for February 2023

  Severity

  Critical 4

  Qualys ID

  91986

  Vendor Reference

  CVE-2023-21808

  CVE Reference

  CVE-2023-21808

  CVSS Scores

  Base 4.6 / Temporal 3.4

  Description

  Microsoft has released a security Update for .NET which resolves Remote Code Execution Vulnerability.
  This security update is rated Important for affected versions of .NET

  Affected versions:
  .NET 6.0 before version 6.0.14
  .NET 7.0 before version 7.0.3
  

  QID Detection Logic: Authenticated
  On Windows, this QID detects vulnerable versions of Microsoft .NET by checking the file version.
  On Linux, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" and "/root/shared/Microsoft.NETCore.App" folders.
  On Mac, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" folder.
  

  Consequence

  
  Vulnerable versions of Microsoft .NET are prone to Remote Code Execution Vulnerability.
  

  Solution

  Customers are advised to refer to CVE-2023-21808 for more details pertaining to this vulnerability.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CVE-2023-21808

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.