Critical #0day in #Outlook fixed. CVE-2023-23397 exploited by #FancyBear to breach government, military, energy, and transportation orgs. Reported by CERT-UA so probably used in Russia's war against Ukraine. The flaw can be used to steal NTLM Hashes of victims. To cite: Threat actors can exploit it by sending messages with extended MAPI properties containing UNC paths to an SMB share (TCP 445) under their control. "The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation BEFORE the email is viewed in the Preview Pane," Microsoft says in a security advisory published today. "The connection to the remote SMB server sends the user's NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication," Redmond explains added in a separate blog post. CVE-2023-23397 impacts all supported versions of Microsoft Outlook for Windows but doesn't affect Outlook for Android, iOS, or macOS versions. Additionally, since online services like Outlook on the web and Microsoft 365 do not support NTLM authentication, they are not vulnerable to attacks exploiting this NTLM relay vulnerability. Patches are out so #Patch now! #infosec #vulnerabilty #news