CVE-2023-35349 & CVE-2023-36434: Two Critical Vulnerabilities Headline Microsoft’s October 2023 Patch Tuesday Post

On October 10, 2023, Microsoft published their October 2023 Security Update including patches for 104 vulnerabilities. Among these vulnerabilities, Arctic Wolf has highlighted two with a critical CVSS of 9.8 and three that are actively exploited.  

Impacted Product #1: Windows 

Vulnerabilities Impacting Windows:  

Impacted Product #2: Skype for Business 

Skype for Business Server 2019 CU7, Skype for Business Server 2015 CU13 

Vulnerabilities Impacting Skype for Business: 

Impacted Product #3: Microsoft .NET Framework and Microsoft Visual Studio 

Vulnerabilities Impacting Microsoft .NET and Microsoft Visual Studio:  

Recommendations for CVE-2023-35349 & CVE-2023-36434

Arctic Wolf strongly recommends applying the available security updates to all impacted products to prevent potential exploitation. 

Note: Please follow your organization’s patching and testing guidelines to avoid any operational impact. 

Workarounds  

Workaround #1: Disable Message Queuing Service if not Required 

To be vulnerable, CVE-2023-35349 requires the Message Queuing (MSMQ) service to be enabled. Consider disabling MSMQ if the service is not required in your environment to prevent exploitation. 

Note: You can check by looking for a service running named “Message Queuing” and for TCP port 1801 listening on the system. 

If disabling MSMQ is not feasible, consider blocking inbound connections to TCP port 1801 from suspicious sources. 

Workaround #2: Disable HTTP/2 Using the Registry Editor  

Note: Using the the Registry Editor can create serious errors that could potential require you to reinstall your entire operating system. Use the Registry Editor at your own risk and ensure you create a backup before you make any changes. 

Microsoft provided workaround for CVE-2023-44487 (Disabling HTTP/2 via Registry Editor): 

1. Click Start, click Run, type Regedit in the Open box, and then click OK. 

1. Locate and then click the following registry subkey: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters 

1. Set DWORD type values EnableHttp2TIs and EnableHttp2Cleartext to one of the following: 

• Set to 0 to disable HTTP/2 

• Set to 1 to enable HTTP/2 

1. Exit Registry Editor. 

1. Restart the computer. 

Workaround #3: Include a Protocols Setting to Limit Your Application to HTTP/1.1 for Each Kestrel Endpoint 

To mitigate CVE-2023-44487, you can limit your application to HTTP/1.1 by editing appsettings.json for each endpoint as follows: 

“Kestrel”: { 

   “Endpoints”: {  

     “http”: {  

       // your existing config  

       “Protocols”: “Http1”  

     },  

     “https”: {  

        // your existing config  

       “Protocols”: “Http1”  

     }  

   }  

 } 

References 

• Microsoft October 2023 Patch Tuesday
• Security Update Guide – Microsoft Security Response Center  
• Google blog post on CVE-2023-44487  
• Google Cloud mitigated largest DDoS attack, peaking above 398 million rps | Google Cloud Blog