July 23, 2024
Microsoft Patch Tuesday, July 2024 Version – Krebs on Safety

Microsoft Corp. at this time issued software program updates to plug not less than 139 safety holes in varied flavors of Home windows and different Microsoft merchandise. Redmond says attackers are already exploiting not less than two of the vulnerabilities in energetic assaults towards Home windows customers.

The primary Microsoft zero-day this month is CVE-2024-38080, a bug within the Home windows Hyper-V element that impacts Home windows 11 and Home windows Server 2022 methods. CVE-2024-38080 permits an attacker to extend their account privileges on a Home windows machine. Though Microsoft says this flaw is being exploited, it has supplied scant particulars about its exploitation.

The opposite zero-day is CVE-2024-38112, which is a weak spot in MSHTML, the proprietary engine of Microsoft’s Web Explorer internet browser. Kevin Breen, senior director of risk analysis at Immersive Labs, stated exploitation of CVE-2024-38112 seemingly requires the usage of an “assault chain” of exploits or programmatic adjustments on the goal host, a la Microsoft’s description: “Profitable exploitation of this vulnerability requires an attacker to take extra actions previous to exploitation to organize the goal atmosphere.”

“Regardless of the dearth of particulars given within the preliminary advisory, this vulnerability impacts all hosts from Home windows Server 2008 R2 onwards, together with shoppers,” Breen stated. “As a consequence of energetic exploitation within the wild this one must be prioritized for patching.”

Satnam Narang, senior workers analysis engineer at Tenable, known as particular consideration to CVE-2024-38021, a distant code execution flaw in Microsoft Workplace. Assaults on this weak spot would result in the disclosure of NTLM hashes, which may very well be leveraged as a part of an NTLM relay or “cross the hash” assault, which lets an attacker masquerade as a official person with out ever having to log in.

“One of many extra profitable assault campaigns from 2023 used CVE-2023-23397, an elevation of privilege bug in Microsoft Outlook that would additionally leak NTLM hashes,” Narang stated. “Nonetheless, CVE-2024-38021 is proscribed by the truth that the Preview Pane shouldn’t be an assault vector, which implies that exploitation wouldn’t happen simply by merely previewing the file.”

The safety agency Morphisec, credited with reporting CVE-2024-38021 to Microsoft, stated it respectfully disagrees with Microsoft’s “necessary” severity ranking, arguing the Workplace flaw deserves a extra dire “essential” ranking given how straightforward it’s for attackers to use.

“Their evaluation differentiates between trusted and untrusted senders, noting that whereas the vulnerability is zero-click for trusted senders, it requires one click on person interplay for untrusted senders,” Morphisec’s Michael Gorelik stated in a blog post about their discovery. “This reassessment is essential to replicate the true threat and guarantee ample consideration and assets are allotted for mitigation.”

In final month’s Patch Tuesday, Microsoft mounted a flaw in its Home windows WiFi driver that attackers may use to put in malicious software program simply by sending a weak Home windows host a specifically crafted information packet over an area community. Jason Kikta at Automox stated this month’s CVE-2024-38053 — a safety weak spot in Home windows Layer Two Bridge Community — is one other native community “ping-of-death” vulnerability that must be a precedence for street warriors to patch.

“This requires shut entry to a goal,” Kikta stated. “Whereas that precludes a ransomware actor in Russia, it’s one thing that’s outdoors of most present risk fashions. Such a exploit works in locations like shared workplace environments, lodges, conference facilities, and wherever else the place unknown computer systems is likely to be utilizing the identical bodily hyperlink as you.”

Automox additionally highlighted three vulnerabilities in Home windows Distant Desktop a service that allocates Shopper Entry Licenses (CALs) when a consumer connects to a distant desktop host (CVE-2024-38077, CVE-2024-38074, and CVE-2024-38076). All three bugs have been assigned a CVSS rating of 9.8 (out of 10) and point out {that a} malicious packet may set off the vulnerability.

Tyler Reguly at Forta famous that at this time marks the Finish of Assist date for SQL Server 2014, a platform that in line with Shodan nonetheless has ~110,000 cases publicly out there. On prime of that, greater than 1 / 4 of all vulnerabilities Microsoft mounted this month are in SQL server.

“Loads of corporations don’t replace shortly, however this may occasionally depart them scrambling to replace these environments to supported variations of MS-SQL,” Reguly stated.

It’s a good suggestion for Home windows end-users to remain present with safety updates from Microsoft, which may shortly pile up in any other case. That doesn’t imply you need to set up them on Patch Tuesday. Certainly, ready a day or three earlier than updating is a sane response, on condition that typically updates go awry and normally inside just a few days Microsoft has mounted any points with its patches. It’s additionally sensible to again up your information and/or picture your Home windows drive earlier than making use of new updates.

For a extra detailed breakdown of the person flaws addressed by Microsoft at this time, take a look at the SANS Internet Storm Center’s list. For these admins liable for sustaining bigger Home windows environments, it typically pays to regulate Askwoody.com, which often factors out when particular Microsoft updates are creating issues for plenty of customers.

As ever, in case you expertise any issues making use of any of those updates, take into account dropping a word about it within the feedback; chances are high first rate another person studying right here has skilled the identical problem, and perhaps even has an answer.