CERT-In Vulnerability Note
CIVN-2023-0232
Multiple vulnerabilities in Microsoft Message Queuing
Original Issue Date:August 10, 2023
Severity Rating: HIGH
Software Affected
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2016 (Server Core installation)
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2012 R2
- Windows Server 2012 (Server Core installation)
- Windows Server 2012
- Windows Server 2016
- Windows Server 2019 (Server Core installation)
- Windows Server 2019
- Windows Server 2022 (Server Core installation)
- Windows Server 2022
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows 10 Version 22H2 for 32-bit Systems
- Windows 10 Version 22H2 for ARM64-based Systems
- Windows 10 Version 22H2 for x64-based Systems
- Windows 10 Version 21H2 for x64-based Systems
- Windows 10 Version 21H2 for ARM64-based Systems
- Windows 10 Version 21H2 for 32-bit Systems
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
- Windows 11 version 21H2 for ARM64-based Systems
- Windows 11 version 21H2 for x64-based Systems
- Windows 11 version 21H2 for x64-based Systems
- Windows 11 Version 22H2 for x64-based Systems
- Windows 11 Version 22H2 for ARM64-based Systems
Overview
Multiple Vulnerabilities have been reported in Microsoft Message Queuing which could be exploited by a remote attacker to execute arbitrary code on the targeted system.
Description
These vulnerabilities exist in Microsoft Message Queuing due to a flaw in Message Queuing component. A remote attacker could exploit these vulnerabilities by sending a specially-crafted request.
Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code on the targeted system.
Solution
Apply appropriate updates as mentioned:
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35385
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36910
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36911
Vendor Information
Microsoft
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35385
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36910
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36911
References
Microsoft
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35385
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36910
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36911
CVE Name
CVE-2023-35385
CVE-2023-36910
CVE-2023-36911
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|