Microsoft Patch Tuesday – January 2023

Patch Tuesday is once again upon us. The January 2023 edition of Patch Tuesday brings us 101 fixes, with 11 rated as critical. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the January 2023 Patch Tuesday Audit Report

Microsoft SharePoint Server Security Feature Bypass Vulnerability

The most severe issue addressed this month is a Sharepoint vulnerability, CVE-2023-21743. While the CVSS base score is quite low at 5.3. Microsoft has listed it as one of the critical vulnerabilities and has listed that exploitation is more likely.

Once the latest updated have been applied Microsoft mentions that additional steps are still required to fully secure your Sharepoint:

Customers must also trigger a SharePoint upgrade action included in this update to protect their SharePoint farm. The upgrade action can be triggered by running the SharePoint Products Configuration Wizard, the Upgrade-SPFarm PowerShell cmdlet, or the «psconfig.exe -cmd upgrade -inplace b2b» command on each SharePoint server after installing the update.

Additionally, CVE-2023-21742 and CVE-2023-21744 were also Sharepoint vulnerabilities that got fixed.

Windows Layer 2 Tunneling Protocol RCE

A majority of the remaining critical vulnerabilities are issues in the Windows Layer 2 Tunneling Protocol (L2TP). All of them having a CVSS base score of 8.1.

• CVE-2023-21679
• CVE-2023-21556
• CVE-2023-21555
• CVE-2023-21546
• CVE-2023-21543

To exploit this, an unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine.

Microsoft Cryptographic Services Vulnerabilities

Multiple vulnerabilities have been fixed in the Microsoft Cryptographic Services. The vulnerabilities include elevation of privilege and information disclosure vulnerabilities with CVSS base score ranging between 5.5 and 8.8.

• CVE-2023-21730
• CVE-2023-21561
• CVE-2023-21559
• CVE-2023-21551
• CVE-2023-21550
• CVE-2023-21540

For the elevation of privilege vulnerabilities, successful exploitation can lead to the attacker gaining SYSTEM privileges. For the information disclosure vulnerabilities, Microsoft lists that the information disclosed would be Windows cryptographic secrets.

Microsoft Exchange Vulnerabilities

Microsoft Exchange got 5 fixes this month. CVE-2023-21745, CVE-2023-21761, CVE-2023-21762, CVE-2023-21763, and CVE-2023-21764. A bit of a mixed bag with two spoofing vulnerabilities, one information disclosure and two elevation of privilege vulnerabilities.

Run the Patch Tuesday January 2023 Audit

To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

The Lansweeper Patch Tuesday report is automatically added to Lansweeper Cloud sites. Lansweeper Cloud is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one report, automatically added every patch Tuesday!

Patch Tuesday January 2023 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" señala los campos obligatorios

Email*

This field is hidden when viewing the form

EmailType

This field is hidden when viewing the form

IM – Conv Page – Processing

This field is hidden when viewing the form

IM – UTM_Campaign FC – Processing

This field is hidden when viewing the form

IM – UTM_Campaign LC – Processing

This field is hidden when viewing the form

IM – UTM_Content FC – Processing

This field is hidden when viewing the form

IM – UTM_Content LC – Processing

This field is hidden when viewing the form

IM – UTM_Medium FC – Processing

This field is hidden when viewing the form

IM – UTM_Medium LC – Processing

This field is hidden when viewing the form

IM – UTM_Source FC – Processing

This field is hidden when viewing the form

IM – UTM_Source LC – Processing

This field is hidden when viewing the form

IM – UTM_Term FC – Processing

This field is hidden when viewing the form

IM – UTM_Term LC – Processing

This field is hidden when viewing the form

gclid

This field is hidden when viewing the form

msclkid

Phone

Este campo es un campo de validación y debe quedar sin cambios.

Count Me In Submit