Microsoft January 2023 Patch fixes 98 flaws, 1 zero-day

It's Microsoft's first 2023 Patch Day, and with it comes fixes for an actively exploited zero-day vulnerability and a total of 98 flaws.

Microsoft gave the vulnerabilities this severity rating as they allow remote code execution, bypass security features, or elevate privileges.

The number of bugs in each vulnerability category is listed below:

• 39 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 33 Remote Code Execution Vulnerabilities
• 10 Information Disclosure Vulnerabilities
• 10 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

One zero-day fixed

This month's Patch Tuesday fixes one zero-day vulnerability, one actively exploited and the other publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited zero-day vulnerability fixed in today's updates is:

CVE-2023-21674 - Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability discovered by Jan Vojtěšek, Milánek, and Przemek Gmerek of Avast.

Microsoft states that this is a Sandbox escape vulnerability that can lead to the elevation of privileges.

"An attacker who successfully exploited this vulnerability could gain SYSTEM privileges," explains Microsoft's advisory.

Avast shared the following information about the zero-day with BleepingComputer:

"We have discovered the zero-day by using our anti-exploit engine, which monitors for suspicious application behavior and detects indicators of ongoing exploitation activity. We observed an active exploitation of the vulnerability, and also can say that the vulnerability is likely part of a longer infection chain through browser, because for the CVE-2023-21674 exploit to work, the attackers already had to somehow obtain the ability to run arbitrary native code inside a sandboxed renderer process. This is something that is normally not possible against a fully patched browser unless the attackers possess a separate renderer 0-day exploit. However, we do not have the full chain." - Avast.

Microsoft also stated that 'CVE-2023-21549 - Windows SMB Witness Service Elevation of Privilege Vulnerability' was publicly disclosed.

However, we were  told by Akamai security researcher Stiv Kupchik that they followed the regular disclosure process and the vulnerability should not be classified as publicly disclosed.

Recent updates from other companies

Other vendors who released updates in January 2023 include:

• Adobe released security updates for numerous products.
• Cisco released security updates for Cisco Identity Services.
• Fortinet released security updates for various products.
• Intel released a security update for oneAPI Toolkits.
• SAP has released its January 2023 Patch Day updates.
• Synology released a security update for its Synology VPN Plus Server.

The January 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities and released advisories in the January 2023 Patch Tuesday updates.