Rackspace Technology is aware of recently published security vulnerabilities impacting the Microsoft Windows Operating Systems. On February 14, 2023 Microsoft issued patches for 80 vulnerabilities, of which 9 are critical and 3 are actively exploited as 0-days.<\/p>\n
Rackspace engineers have performed an initial assessment and are advising customers to ensure February 2023 Windows Patches are installed as there are not any known software mitigations or workarounds for these vulnerabilities.<\/strong> Rackspace customers using our Managed Patching Service will be patched during normal patching cycles.<\/p>\n For those customers not using Rackspace Managed Patching we recommend patching devices as soon as possible to mitigate these vulnerabilities. Customers not using our Managed Patching Service can install the latest Windows UPDATEs themselves or can request that Rackspace perform patching by contacting Rackspace Support.<\/p>\n Below you will find a partial list of vulnerabilities Rackspace is highlighting impacting Microsoft Windows Graphic Component, Word, Servers, and Exchange. For a full list of February Security, you can follow this link: https:\/\/msrc.microsoft.com\/UPDATE-guide\/releaseNote\/2023-Feb<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21689: <\/strong>Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>All supported versions of Windows<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21689<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21823: <\/strong>Windows Graphics Component Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>All supported versions of Windows, Office for Universal, Office for Android<\/p>\n Notes: <\/strong>The Microsoft Store will automatically UPDATE affected customers.<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21823<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21716: <\/strong>Microsoft Word Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>Microsoft (MS) 365 Apps for Enterprise, MS Office LTSC 2021, MS Office LTSC for Mac 2021, MS Office 2019 for Mac, MS Office Online Server, MS Office Web Apps Server 2013, MS Word 2016, MS Word 2013, MS SharePoint Server 2019, MS SharePoint Enterprise Server 2016, MS SharePoint Server 2013, MS SharePoint Foundation 2013, MS SharePoint Server Subscription Edition, SharePoint Server Subscription Edition Language Pack<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21716<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21707: <\/strong>Microsoft Exchange Server Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>Microsoft Exchange Server 2013 Cumulative UPDATE 23,Microsoft Exchange Server 2019 Cumulative UPDATE 11,Microsoft Exchange Server 2019 Cumulative UPDATE 12, Microsoft Exchange Server 2016 Cumulative UPDATE 23<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21707<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21803: <\/strong>Windows iSCSI Discovery Service Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>Windows 10 Version 22H2, Windows 10 Version 21H2, Windows 10 Version 20H2<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21803<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21717: <\/strong>Microsoft SharePoint Server Elevation of Privilege Vulnerability<\/p>\n Impact: <\/strong>Elevation of Privilege<\/p>\n Affected Software:<\/strong>Microsoft SharePoint Server 2019, SharePoint Enterprise Server 2016, SharePoint Enterprise Server 2013, SharePoint Foundation 2013 Service, Microsoft SharePoint Server Subscription Edition<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21717<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21684: <\/strong>Microsoft Postscript Printer Driver Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>All supported versions of Windows<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21684<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21799<\/strong>Microsoft WDAC OLE DB provider for SQL Server Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>All supported versions of Windows<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21799<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21797: <\/strong>Microsoft ODBC Driver Remote Code EXECution Vulnerability<\/p>\n Impact: <\/strong>Remote Code EXECution<\/p>\n Affected Software: <\/strong>All supported versions of Windows<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21797<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-23376: <\/strong>Windows Common Log File System Driver Elevation of Privilege Vulnerability<\/p>\n Impact: <\/strong>Elevation of Privilege<\/p>\n Affected Software: <\/strong>All supported versions of Windows<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-23376<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21813: <\/strong>Windows Secure Channel Denial of Service Vulnerability<\/p>\n Impact: <\/strong>Denial of Service<\/p>\n Affected Software: <\/strong>All supported versions of Windows<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21813<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21715<\/strong>M: icrosoft Publisher Security Feature Bypass Vulnerability<\/p>\n Impact: <\/strong>Security Feature Bypass<\/p>\n Affected Software: <\/strong>Microsoft 365 Apps for Enterprise<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21715<\/a><\/p>\n Vulnerability & Details<\/u><\/p>\n CVE-2023-21817: <\/strong>Windows Kerberos Elevation of Privilege Vulnerability<\/p>\n Impact: <\/strong>Elevation of Privilege<\/p>\n Affected Software:<\/strong>All supported versions of Windows<\/p>\n More Information: <\/strong>https:\/\/msrc.microsoft.com\/UPDATE-guide\/vulnerability\/CVE-2023-21817<\/a><\/p>\n Our security teams are actively monitoring the situation and will provide any associated UPDATEs via this blog.<\/p>\n Note – Reboot Issue with KB5022842 and Windows Server 2022 VMs on VMWare using Secure Boot<\/strong><\/p>\n It\u2019s important to note there is a known issue with KB5022842 affecting Windows Server 2022 virtual machines on VMWare ESX vSphere ESXi 6.7 U2\/U3 or vSphere ESXi 7.0.x. where, if SecureBoot is enabled for the virtual machine, the virtual machine will not boot up. VMWare and Microsoft are working to remediate the issue with an upcoming patch. Until a patch is released the following recommendations should be followed to avoid this issue.<\/p>\n In addition please note the following regarding remediation.<\/p>\n\n
\n