SB2023041220 - Multiple vulnerabilities in Microsoft Windows Boot Manager

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Security features bypass (CVE-ID: CVE-2023-28269)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to security features bypass in Windows Boot Manager. An administrator with physical access can bypass Secure Boot and execute arbitrary code on the target system.

2) Security features bypass (CVE-ID: CVE-2023-28249)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to security features bypass in Windows Boot Manager. An administrator with physical access can bypass Secure Boot and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-28269
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28249