ACSC reviews Microsoft’s July 2023 Security Update, Calls Nine Vulnerabilities ‘Critical’  

The Australian Cyber Security Centre (ACSC) has analysed and released details of the vulnerabilities found in Microsoft’s July Security update and has informed about 9 threats being ‘critical’.

The Microsoft July 2023 Security Update has been examined by the Australian Cyber Security Centre (ACSC).

The key highlights of ACSC’s analysis are given below:

• Patches were made available for 132 vulnerabilities by the security update.
• It is thought that 6 vulnerabilities have been exploited.
• ‘Critical’ security ratings have been assigned to 9 vulnerabilities.

Important Vulnerabilities to be Noted

Based on their severity, the extent to which the connected product is used, and/or the chance that it will be exploited, the following vulnerabilities are significant:

1. Office and Windows HTML RCE unpatched 0-day (CVE-2023-36884)

This vulnerability is described as follows by ACSC to help users spot them:

• A vulnerability with a Critical rating that enables Arbitrary Code Execution when victims are persuaded to open a malicious file.
• It’s possible that the malicious file is of a type that the user would probably think to be secure, such as a Word document without macros.
• This zero-day vulnerability is being actively exploited.

Since a fix from Microsoft has not yet been released, all impacted users are urged to utilise mitigations. The Microsoft Guide available on their website lists mitigations.

When it comes to the system administrators, they need to watch out for a fix for this in next monthly Microsoft releases.

2. Windows Remote Desktop Authentication Bypass (CVE-2023-35352)

• An authentication configuration bypass vulnerability with a Critical security rating.
• When starting a session using the remote desktop protocol, avoid using a bypass certificate or private key authentication.
• RDP is frequently used by businesses to connect internal systems and distant personnel.

3. Windows Message Queuing RCE (CVE-2023-32057)

• This vulnerability has a Critical rating and permits remote code execution by attackers.
• MSMQ is not always activated. By searching for a service with the name “Message Queuing,” a user can determine whether MSMQ is active.
• The availability of TCP Port 1801 on the device may also be verified by the user.

Mitigation Tips to Stay Secure

Technical subject matter experts that use Microsoft products should read the associated security update guides available for their products.

General users should consider enabling automatic patching of Microsoft products if they have not already done so. Advice is available on the Protect Yourself: Updates page.

Guide on Updating Various Software

To address any security issues and enhance functionality, software developers frequently provide updates for their products. When a new version of a piece of software is published, it will often prompt users to update, and they should update as soon as they can.

By regularly updating your software, users effectively close any known vulnerabilities that hackers could try to exploit. since cybercriminals are constantly searching for flaws or vulnerabilities.

However, you should replace any equipment that can no longer be updated.

Where feasible, enabling or approving automatic updates is the simplest approach to keep current. An automated update is a function that searches for, downloads, and installs updates while often asking you when it would be best for you to install them. You can unwind knowing that you are constantly utilising the most secure version in this manner.

In this guide, we have covered steps to update Windows, Apple, and Android devices is covered in this guide. Consult the manufacturer for advice on additional goods, such as routers and smart devices. You can also contact Anitech for assistance.

1. Windows

Windows Update, a tool that automatically downloads and installs Microsoft Windows software updates over the Internet as they become available, is used by default by Windows operating systems.

Windows provides both quality and feature upgrades. The two times a year that feature upgrades are normally released contain new capabilities and features in addition to potential repairs and security patches. The majority of quality updates are security and bug fixes, which are released more often. Language packs, among other optional upgrades, are not always deployed automatically.

Users may alter when Windows installs their updates and set Windows Update to notify them when updates are ready, allowing them to continue working uninterrupted.

Users can refer to Microsoft’s FAQ on Windows Update for more information on updates that are particular to your version of Windows.

Additionally, users may manually or automatically update apps that they’ve downloaded from the Windows Store on their device. See how to manually download app updates and how to enable automatic app updates for additional details.

2. Apple

Numerous updates for your Apple device can be installed automatically. This covers background security updates, operating system upgrades, and App Store updates for iPhone, iPad, Mac, and Apple Watch. Your Apple devices will update during the course of the night if they are charging and connected to Wi-Fi and have automatic updates enabled.

Apple also provides free operating system updates for new versions of iOS and macOS. Although you will get a message and need to have your device plugged in and connected to the internet, upgrades can be downloaded and installed automatically. In the Software Update system options, you may manually look for macOS updates as well.

Users may refer to guides provided by Apple on how to update macOS, how to update your iPhone, iPad, or iPod touch to the most recent version of iOS or iPadOS, and how to update the Apple Watch for additional details.

Users may enable automatic App Updates or go to the App Store and select which applications they want to manually update in order to update apps that they have downloaded from the App Store. See How to Update Apps on Your Apple Device for additional details.

3. Android

Google periodically releases system updates to keep your device safe and functional. Nevertheless, depending on the device manufacturer, not all Android devices get timely updates and fixes.

Normally, Google System services update your device for security, bug fixes, and new features automatically. When an update for your Android operating system becomes available, you’ll instantly get a notification. When you receive an update notice, tap it to begin the process. Be careful to pay attention to any instructions or prompts that appear.

Different manufacturers produce Android devices, and each has a unique procedure for installing system updates. Verify the instructions on the manufacturer’s website. See how to enable updates on your Android smartphone for additional details.

Apps that users have downloaded from the Google Play Store can be updated manually or automatically on an Android smartphone. See how to update applications on Android for additional details.

4. Other Devices

Where feasible, remember to enable automatic updates for other hardware and software. We recommend consulting the product’s maker if you’re unsure.

Some Common Queries

What if the Automatic Update Setting is Unavailable?

Users should routinely check for and install fresh updates through their software or device’s settings menu if the automatic update setting is not accessible.

What if an Older Device and Software do not Receive any Updates?

Any device, operating system, or software may no longer get manufacturer or developer support if it is too old. As soon as a product reaches this “end of support” stage, it will no longer get updates, leaving users open to known software “bugs” that might lead to cyberattacks.

Manufacturers may also use the terms “vintage,” “outdated,” or “unsupported” to describe these items.

The iPhone 6 and the Windows 7 operating system are two examples of items that no longer get support.

We advise updating if your software, operating system, or device has reached the end of support to be safe.

Checklist to Follow

Users can follow the below-given checklist to update their software:

• Verify that your device satisfies the requirements for new upgrades. Check the End of Support guidance to see if your software or device is too old to get updates. As soon as you can, upgrade to a product that is supported.
• As part of the initial setup when you buy a new device, check for updates right away.
• If you can, enable automatic updates.
• Before updating your operating system to a newer version, make a backup of your data and files.
• Check to see if your storage is full; devices with insufficient capacity may not be able to install the most recent updates.
• If the automatic update setting is not accessible, often check for software and application updates.

How can Anitech help?

An information security consultant is well-versed with complex terms and processes and can help users understand the various steps mentioned above for updating Software.

Our Anitech’s experienced consultants can help you in the same way as they can assist your organisation with a robust security plan.

Call us now at– 1300 802 163 or e-mail – sales@anitechgroup.com.