Microsoft Patch Tuesday – July 2023

Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The July 2023 edition of Patch Tuesday brings us 130 new fixes, with 9 rated as critical. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the July 2023 Patch Tuesday Audit Report

Five Microsoft SharePoint Vulnerabilities

Just like last month, the most noteworthy fixes are for SharePoint. Sharepoint got a total of 5 vulnerabilities fixed, two of which are critical.

CVE-2023-33157 is the most severe of the five. A Remote Code Execution (RCE) vulnerability in Sharepoint Server that is “more likely” to be exploited according to Microsoft. To exploit this vulnerability, an attacker will need to be authenticated and also a site member (and have the Manage List permissions), so there are some prerequisites. If these two conditions are both achieved, it is possible for the attacker to execute code remotely.

CVE-2023-33160 is the second most severe vulnerability. While it also have the same CVSS base score of 8.8, it is not as likely to be exploited. The prerequisites of this vulnerability are similar to the one above and if exploited it can lead to “a remote attack that could enable access to the victim’s information and the ability to alter information. Successful exploitation could also potentially cause downtime for the targeted environment.“

The other vulnerabilities, CVE-2023-33165, CVE-2023-33159, and CVE-2023-33134 are less severe according to Microsoft and range from a CVSS base score of 4.4 to 8.8. These vulnerabilities are a security feature bypass, spoofing and a second RCE vulnerability.

Three Windows Remote Desktop Vulnerabilities

The second set of vulnerabilities that pose a high risk are in the Windows Remote Desktop. CVE-2023-35352 is the most critical vulnerability simply listed as a security feature bypass vulnerability. Information is rather scarce for this vulnerability, Microsoft lists that exploitation is “more likely”, which indicates there is a significant risk. Aside from that all we get regarding the vulnerability is what happens if it is exploited.

An attacker who successfully exploited the vulnerability could bypass certificate or private key authentication when establishing a remote desktop protocol session.

The remaining two vulnerabilities, CVE-2023-32043 and CVE-2023-35332 both have a CVSS base score of 6.8. With these vulnerabilities we at least get some idea of which security features are being bypassed. Specifically, the certificate validation performed when a targeted user connects to a trusted server and the usage of the Datagram Transport Layer Security (DTLS) version 1.0 protocol.

Run the Patch Tuesday July 2023 Audit

To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

The Lansweeper Patch Tuesday report is automatically added to your Lansweeper Site. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one report, automatically added every patch Tuesday!

Patch Tuesday July 2023 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" indicates required fields

Email*

Hidden

EmailType

Hidden

IM – Conv Page – Processing

Hidden

IM – UTM_Campaign FC – Processing

Hidden

IM – UTM_Campaign LC – Processing

Hidden

IM – UTM_Content FC – Processing

Hidden

IM – UTM_Content LC – Processing

Hidden

IM – UTM_Medium FC – Processing

Hidden

IM – UTM_Medium LC – Processing

Hidden

IM – UTM_Source FC – Processing

Hidden

IM – UTM_Source LC – Processing

Hidden

IM – UTM_Term FC – Processing

Hidden

IM – UTM_Term LC – Processing

Hidden

gclid

Hidden

msclkid

Comments

This field is for validation purposes and should be left unchanged.

Count Me In Submit