From f73287ce98162863e3c08c8f19e3c2e16f21f963 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 21 Mar 2023 15:48:02 -0500 Subject: [PATCH 1/3] minor --- .../cve_2023_23397_pidlidreminder_privilege_escalation.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml b/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml index 1a1b372dab..2420c098e5 100644 --- a/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml +++ b/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml @@ -4,10 +4,11 @@ version: 1 date: '2023-03-15' author: Michael Haag, Splunk description: Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. -narrative: Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure. - CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required. +narrative: Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\ - The connection to the remote SMB server sends the user''s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. Online services such as Microsoft 365 do not support NTLM authentication and are not vulnerable to being attacked by these messages. (2023, Microsoft) + CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\ + + The connection to the remote SMB server sends the user''s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. Online services such as Microsoft 365 do not support NTLM authentication and are not vulnerable to being attacked by these messages. (2023, Microsoft) references: - https://twitter.com/ACEResponder/status/1636116096506818562?s=20 - https://twitter.com/domchell/status/1635999068282408962?s=20 From 2d66f943b350bb9082e3f4a97b442c01bc519da1 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 21 Mar 2023 15:49:13 -0500 Subject: [PATCH 2/3] space --- .../cve_2023_23397_pidlidreminder_privilege_escalation.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml b/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml index 2420c098e5..3a51c931d6 100644 --- a/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml +++ b/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml @@ -5,10 +5,8 @@ date: '2023-03-15' author: Michael Haag, Splunk description: Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. narrative: Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\ - CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\ - - The connection to the remote SMB server sends the user''s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. Online services such as Microsoft 365 do not support NTLM authentication and are not vulnerable to being attacked by these messages. (2023, Microsoft) + The connection to the remote SMB server sends the user''s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. Online services such as Microsoft 365 do not support NTLM authentication and are not vulnerable to being attacked by these messages. (2023, Microsoft) references: - https://twitter.com/ACEResponder/status/1636116096506818562?s=20 - https://twitter.com/domchell/status/1635999068282408962?s=20 From bfa37e96e3710fa10656d05fbd49ce652a85f551 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 21 Mar 2023 15:52:17 -0500 Subject: [PATCH 3/3] rename story --- ...tion.yml => cve_2023_23397_outlook_elevation_of_privilege.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename stories/{cve_2023_23397_pidlidreminder_privilege_escalation.yml => cve_2023_23397_outlook_elevation_of_privilege.yml} (100%) diff --git a/stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml b/stories/cve_2023_23397_outlook_elevation_of_privilege.yml similarity index 100% rename from stories/cve_2023_23397_pidlidreminder_privilege_escalation.yml rename to stories/cve_2023_23397_outlook_elevation_of_privilege.yml