Security News > 2023 > May > Easily bypassed patch makes zero-click Outlook flaw exploitable again (CVE-2023-29324)

Among the vulnerabilities fixed by Microsoft on May 2023 Patch Tuesday is CVE-2023-29324, a bug in the Windows MSHTML platform that Microsoft rates as "Important."

Akamai's research team and Ben Barnea, the researcher who's credited with finding the flaw, disagree with that assessment, because "The new vulnerability re-enables the exploitation of a critical vulnerability that was seen in the wild and used by APT operators."

CVE-2023-23397 is an EoP bug in Microsoft Outlook that can be triggered without user interaction.

"External attackers could send specially crafted emails that will cause a connection from the victim to an untrusted location of attackers' control. This will leak the Net-NTLMv2 hash of the victim to the untrusted network which an attacker can then relay to another service and authenticate as the victim," Microsoft explained in March 2023, when it provided a fix.

CVE-2023-29324, on the other hand, is defined as a security feature bypass vulnerability that, according to Akamai researchers, could still have the same consequences as the critical original Outlook bug.

"This vulnerability is yet another example of patch scrutinizing leading to new vulnerabilities and bypasses," they noted, and said that they hope Microsoft will fully remove the custom reminder sound feature, as it poses more security risks than it provides value to users.

News URL

https://www.helpnetsecurity.com/2023/05/10/cve-2023-29324/