Microsoft tackles three zero-days for October Patch Tuesday

Microsoft corrected three zero-days that targeted Skype for Business, Microsoft WordPad and the HTTP/2 protocol on October Patch Tuesday.

In total, Microsoft addressed 103 new vulnerabilities with 12 rated critical. The company also issued updates for seven older vulnerabilities, including one recommended Exchange Server update that improves on a fix from August.

The first zero-day, which was also publicly disclosed, is a Skype for Business elevation-of-privilege vulnerability (CVE-2023-41763) rated important. The CVSS rating is low at 5.3, but proof-of-concept code exists, which should make patching these systems a priority. The flaw affects Skype for Business Server 2015 CU13 and Skype for Business Server 2019 CU7.

Through this bug, an attacker can target Skype for Business Server with a specially crafted network call and force the system to reveal IP addresses or port numbers -- or both -- and reveal sensitive details to gain access to internal networks.

Chris Goettl

"The CVE says elevation of privilege, but it's a combination of elevation of privilege with information disclosure," said Chris Goettl, vice president of security product management at Ivanti. "That information can lead them to additional targets of opportunity within the environment."

Also publicly disclosed is a Microsoft WordPad zero-day (CVE-2023-36563), which is an information disclosure vulnerability rated important that affects Windows desktop and server systems. An attacker could use this flaw, which has a 6.5 CVSS rating, to disclose New Technology LAN Manager (NTLM) hashes, which can be used to decrypt a user's credentials. The bug affects Windows server and desktop systems.

Unlike a similar vulnerability in Microsoft Word from September Patch Tuesday, the preview pane is not an attack vector. To exploit the vulnerability, an attacker needs to log into a system and run a specially crafted application to overtake a system. In another scenario, the attacker would have to convince a user to open a malicious WordPad file, either from email or a web page or from an instant message, to exploit the vulnerability and steal the NTLM hashes.

The third zero-day addresses a vulnerability (CVE-2023-44487) at the root of DDoS attacks, called "Rapid Reset," against HTTP/2 endpoints.

"This HTTP/2 vulnerability allows malicious actors to launch a DDoS attack targeting HTTP/2 servers. The attack sends a set number of HTTP requests using HEADERS followed by RST_STREAM and repeating this pattern to generate a high volume of traffic on the targeted HTTP/2 servers. By packing multiple HEADERS and RST_STREAM frames in a single connection, attackers can cause a significant increase in the request per second and high CPU utilization on the servers that eventually can cause resource exhaustion," the Microsoft Security Response Center wrote in a blog.

The HTTP/2 zero-day has no CVSS rating, but it affects several Microsoft products, including ASP.NET Core 7.0, Microsoft Visual Studio 2022, .NET 7.0, and Windows server and desktop systems.

"Microsoft has resolved this HTTP protocol vulnerability in the Windows OS and its development tools. Now, whenever anybody builds an application with HTTP/2, it will use a known, good version of that protocol, not the vulnerable one," Goettl said.