Microsoft Patch Tuesday Archive.

This page holds Brandefense write-ups of Microsoft Patch Tuesday updates. It covers 4 items from March 2023 to August 2024. Each entry keeps its original title, publish date and text, newest first and grouped by quarter. Earlier addresses of these entries now lead to the matching entry here.

Jump to: 2024 Q3 | 2024 Q2 | 2023 Q2 | 2023 Q1

2024 Q3

August’24 Patch Tuesday: Six Actively Exploited Zero-Day Vulnerabilities

Published: 14 August 2024

In its August 2024 Patch Tuesday release, Microsoft addressed 88 vulnerabilities, including seven critical flaws and ten zero-day vulnerabilities. Notably, six of these zero-day vulnerabilities are currently being actively exploited in the wild, underscoring the urgent need for organizations to implement patches without delay.

Comprehensive Update Scope

This extensive update affects a wide range of Microsoft products, including:

• Microsoft Office and Components
• Microsoft Windows DNS
• Windows TCP/IP
• Microsoft Teams
• Windows Secure Boot
• Windows Secure Kernel Mode
• Windows Security Center
• Windows SmartScreen
• Windows App Installer
• Windows Scripting

The vulnerabilities covered include various types such as Spoofing, Denial of Service (DoS), Elevation of Privilege (EoP), Cross-site Scripting (XSS), Information Disclosure, Security Feature Bypass, and the severe Remote Code Execution (RCE).

Zero-Day Vulnerabilities Demand Immediate Attention

The six actively exploited zero-day vulnerabilities, along with three additional publicly disclosed zero-days (CVE-2024-21302, CVE-2024-38202, and CVE-2024-38199), pose a significant threat to both organizations and individuals. Additionally, there is a tenth publicly disclosed zero-day vulnerability (CVE-2024-38200) for which Microsoft has not yet released a patch, further compounding the risk.

Key Zero-Day Vulnerabilities

The following actively exploited zero-day vulnerabilities were addressed in this Patch Tuesday release:

• CVE-2024-38178: Scripting Engine Memory Corruption Vulnerability
  Exploitable when an attacker convinces an authenticated user to visit a specially crafted URL, leading to memory corruption within the scripting engine and potentially arbitrary code execution.

• CVE-2024-38193: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
  This flaw allows attackers to gain SYSTEM privileges by targeting a kernel entry point within the Windows Ancillary Function Driver (AFD) for WinSock, posing a significant security risk due to the potential for deep system access.

• CVE-2024-38213: Windows SmartScreen Security Feature Bypass Vulnerability
  This vulnerability enables attackers to bypass Windows SmartScreen, designed to protect users from malicious websites and downloads. By tricking users into opening a malicious file, the attacker can circumvent SmartScreen’s defenses, leading to further attacks.

• CVE-2024-38106: Windows Kernel Elevation of Privilege Vulnerability
  Involving a race condition within the Windows kernel, this vulnerability can be exploited to gain SYSTEM privileges. Given the kernel’s role as the core of the OS, successful exploitation could have system-wide impacts.

• CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability
  Attackers can exploit this vulnerability in Microsoft Project via email or web-based attacks, potentially leading to remote code execution if a user is tricked into opening a malicious file.

• CVE-2024-38107: Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
  This flaw in the Power Dependency Coordinator component of Modern Standby could allow attackers to gain SYSTEM privileges, presenting a significant risk to affected systems.

CISA’s Response and Recommendations

In response to these threats, the Cybersecurity and Infrastructure Security Agency (CISA) has added the actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog. CISA has mandated that federal agencies patch these vulnerabilities by September 3, 2024.

Recommendation: All users and organizations are strongly advised to prioritize patching these vulnerabilities immediately to mitigate potential risks and safeguard their systems.

2024 Q2

Microsoft June 2024 Patch Tuesday Fixes 51 Flaws, Including 18 RCEs

Published: 12 June 2024

Yesterday marked Microsoft June 2024 Patch Tuesday, which introduces security updates for 51 flaws, including eighteen remote code execution (RCE) flaws and one publicly disclosed zero-day vulnerability.

Key Fixes in This Update

• Critical Vulnerability: This Patch Tuesday addressed 18 RCE flaws but only one critical vulnerability, a remote code execution vulnerability in Microsoft Message Queuing (MSMQ).

Breakdown of Vulnerabilities

• 25 Elevation of Privilege Vulnerabilities
• 18 Remote Code Execution Vulnerabilities
• 3 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities

(Note: The total count of 51 flaws does not include the 7 Microsoft Edge flaws fixed on June 3rd.)

Publicly Disclosed Zero-Day

This month’s Patch Tuesday addresses one publicly disclosed zero-day vulnerability. Notably, no actively exploited flaw was fixed today. Microsoft classifies a zero-day as a flaw that is publicly disclosed or actively exploited without an official fix available.

The publicly disclosed zero-day vulnerability is the previously disclosed ‘Keytrap’ attack in the DNS protocol, which Microsoft has now fixed as part of today’s updates.

• CVE-2023-50868:
  • Description: NSEC3, the closest encloser proof, can exhaust CPU.
  • Impact: This vulnerability in DNSSEC validation could be exploited by attackers to use excessive resources on a resolver, causing a denial of service for legitimate users.
  • History: This flaw was previously disclosed in February and patched in numerous DNS implementations, including BIND, PowerDNS, Unbound, Knot Resolver, and Dnsmasq.

Other Notable Fixes

• Microsoft Office: Multiple remote code execution flaws, including those in Microsoft Outlook, that can be exploited from the preview pane.
• Windows Kernel: Seven privilege elevation flaws that could allow a local attacker to gain SYSTEM privileges.

To access the full description of each vulnerability and the systems it affects, you can view the full report here

Recent Updates from Other Companies

Several other vendors also released updates or advisories in June 2024:

• Apple: Fixed 21 security flaws in the visionOS 1.2 release.
• ARM: Fixed an actively exploited bug in Mali GPU kernel drivers.
• Cisco: Released security updates for Cisco Finesse and Webex.
• Cox: Fixed an API authentication bypass bug affecting millions of modems.
• F5: Released security updates for two high-severity BIG-IP Next Central Manager API flaws.
• PHP: Fixed a critical RCE flaw actively exploited in ransomware attacks.
• TikTok: Fixed an exploited zero-day, zero-click flaw in their direct messages feature.
• VMware: Fixed three zero-day bugs exploited at Pwn2Own 2024.
• Zyxel: Released an emergency RCE patch for end-of-life NAS devices.

2023 Q2

Microsoft Patch Tuesday: June 2023

Published: 14 June 2023

Six Critical Vulnerabilities, No 0-day

Microsoft Patch Tuesday, the company’s monthly security update, has provided fixes for 70 vulnerabilities, 62 classified as important, six as critical, one as moderate, and one as low.

These fixes encompass various software, including Microsoft Office, Microsoft SharePoint, and Windows operating system components. Critical vulnerabilities addressed include CVE-2023-29357 in SharePoint Server 2019 and CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015 in the Windows operating system’s implementation of Pragmatic General Multicast (PGM).

CVE-2023-29357: The Elevation of Privilege vulnerability in Microsoft SharePoint Server 2019 has a CVSSv3 severity score of 9.8 and is labeled critical. An unauthenticated, remote attacker can exploit this vulnerability by sending a spoofed JWT authentication token to the target server, thereby assuming the privileges of an authenticated user on that system.

CVE-2023—29363 / 32014 / 32015: These are Remote Code Execution (RCE) vulnerabilities in Windows Pragmatic General Multicast (PGM) that were assigned a critical severity rating of 9.8. An attacker who successfully exploits these vulnerabilities could execute arbitrary code on the target system with SYSTEM privileges.

Notably, the Elevation of Privilege (EoP) vulnerability CVE-2023-29357 in SharePoint Server 2019 is reported as having been used in a successful chained attack demonstration during the March Pwn2Own Vancouver contest. This vulnerability allows an unauthenticated, remote attacker to gain the privileges of an authenticated user by sending a spoofed JWT authentication token.

Microsoft recommends that users enable AMSI as mitigation, though the efficacy of this action remains untested.

Similarly, the Remote Code Execution (RCE) vulnerabilities in the Windows operating system’s PGM, CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015, could allow an attacker to execute code remotely by sending a malicious file to a vulnerable system. These vulnerabilities are only exploitable on systems with message queueing services enabled.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in various Microsoft Exchange Server versions, allowing an authenticated attacker to execute arbitrary code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in various Microsoft Exchange Server versions, allowing an authenticated attacker to execute arbitrary code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Also, CVE-2023-29362 is an RCE vulnerability in the Remote Desktop Client component of Windows operating systems and the Remote Desktop Client for Windows Desktop applications, which can be exploited by a remote attacker with control over a Remote Desktop Server.

Microsoft urges all users to promptly apply the updates provided in the Patch Tuesday release to ensure their systems are protected against these vulnerabilities. As always, keeping software updated with the latest security patches is one of the best practices for maintaining a secure and resilient system.

Updates ASAP

In March 2023, Microsoft Patch Tuesday updates, Microsoft has released 2 zero-days. After that, BRANDEFENSE Analysts’ investigation, threat actors posted about CVE-2023-24880 on a dark web forum. In the forum post, threat actors said that not all Windows systems had been updated yet, so they could continue to share the PoC. [Read More]

Threat actors always wait for your mistakes. Do not forget your updates.

2023 Q1

Microsoft Fixes Multiple Vulnerabilities In March 2023 Patch Tuesday Updates

Published: 21 March 2023

Microsoft has released its March 2023 Patch Tuesday software updates, which include two zero-days. The first vulnerability is an information disclosure issue that can allow a remote attacker to send specially crafted email messages to a victim’s inbox. This will cause Windows Mail or Outlook to crash and restart, allowing the attacker to obtain the NTLMv2 hash of the victim’s account.

The second vulnerability allows an attacker who has already obtained this hash through other means (such as phishing) or via another exploit like EternalBlue, DoublePulsar, or EternalSynergy (which were all fixed by Microsoft in February) to gain access to any user’s mailbox on an Exchange server running Outlook Web Access (OWA).

CVE-2023-23397

Microsoft has patched a critical elevation of privilege vulnerability in Windows that was exploited by Russian hackers and ransomware actors.

The CVE-2023-23397 vulnerability allows attackers to execute code with elevated privileges on targeted systems. It was used by Strontium (aka APT28), Sednit, Sofacy and Fancy Bear in attacks against government, transportation, and energy sectors in Europe.

Microsoft did not reveal any further details about this flaw but said it was aware of limited, targeted attacks exploiting the bug before releasing its patches last week.

CVE-2023-24880

Microsoft has released a patch for a zero-day vulnerability that was exploited by the Magniber ransomware operation. CVE-2023-24880 is a SmartScreen security feature bypass, and it was used in the Magniber attacks to trick users into downloading malicious MSI files. The vulnerability affected all versions of Windows 10, 8, 7, and Vista operating systems from January 2023 to the present day.

Microsoft said that over 100 000 downloads of malicious MSI files had been detected since January 2023. The company also noted that there’s no evidence these exploits were used in any other attack campaigns apart from Magniber’s operations so far (aside from some reports about an unnamed actor abusing this same vulnerability).

The products and versions affected by the said vulnerabilities;

• Microsoft ICMP (MS18-11)
• Microsoft Excel (MS18-10)
• Microsoft IIS (MS18-09)
• Windows Cryptographic Services (MS18-08)

Exploitation Details

Microsoft has released a patch to fix the vulnerabilities. The company says that it has not seen any attacks in the wild, but security researchers have been able to exploit these flaws in lab environments.

The attack scenario involves an attacker sending a phishing email to users which contains a malicious attachment or link. When the victim clicks on that attachment or link, it downloads malicious code from an attacker-controlled server and executes it locally on their computer. This code can then use one of two methods to obtain NTLMv2 hashes: either through the Net-NTLMv2 hash of the Windows account or through an NTLM Relay attack against another service (such as RDP). Once obtained, these hashes can be used by attackers for authentication purposes when accessing other services such as SharePoint Server 2016 or Exchange Server 2016 running on Microsoft Windows Server 2012 R2 or earlier versions without having access credentials themselves

Prevention

• Keep Your Software Up-To-Date.
• Use Robust Authentication Methods.
• Use Secure Email Practices, Like S/MIME Encryption And Two-Factor Authentication (2FA).

Update

According to BRANDEFENSE Analysts’ investigation, threat actors posted about CVE-2023-24880 on a dark web forum. In the forum post, threat actors said that not all Windows systems had been updated yet, so they could continue to share the PoC.