Microsoft’s latest monthly patch release includes three critical vulnerabilities in its message queuing service, all of which enable remote code execution (RCE). These vulnerabilities are identified as CVE-2023-35385, CVE-2023-36910, and CVE-2023-36911, posing a risk to servers with the Windows Message Queueing service enabled.
Additionally, two vulnerabilities with lower severity ratings have been exploited in the wild. CVE-2023-38180, with a CVSS score of 7.5, is a denial of service bug in .NET and Visual Studio, though specific details have not been disclosed by Microsoft. Another exploited bug, initially revealed in July as CVE-2023-36884, is an RCE in Windows Search, also with a CVSS score of 7.5.
Microsoft clarified that this latter bug could be exploited through email or instant messages containing a crafted file. Interaction with the file, such as clicking a link or opening an attachment, is required for the attack to be successful. The attacker could plant a malicious file, bypassing Mark of the Web (MOTW) defenses and potentially executing code on the victim’s system.
To mitigate these vulnerabilities, Microsoft recommends installing the provided patches, which would address the attack chain leading to the Windows Search security feature bypass (CVE-2023-36884). The advisory also suggests updating Office software along with the Windows updates from August 2023.
The SANS Institute noted that a total of 88 vulnerabilities were announced by Microsoft in this release.