Microsoft Patch Tuesday Archive.

This page holds Brandefense write-ups of Microsoft Patch Tuesday updates. It covers 4 items from March 2023 to August 2024. Each entry keeps its first title, publish date and text, newest first and grouped by quarter. Earlier addresses of these entries now lead to the matching entry here.

Jump to: 2024 Q3 | 2024 Q2 | 2023 Q2 | 2023 Q1

2024 Q3

August’24 Patch Tuesday: Six Actively Exploited Zero-Day Vulnerabilities

Published: 14 August 2024.

In its August 2024 Patch Tuesday release, Microsoft addressed 88 vulnerabilities, including seven critical flaws and ten zero-day vulnerabilities. Six of these zero-day vulnerabilities are being actively exploited in the wild. Firms need to set up patches without delay.

Comprehensive Update Scope

This update affects many Microsoft products, including:

• Microsoft Office and Components.
• Microsoft Windows DNS.
• Windows TCP/IP.
• Microsoft Teams.
• Windows Secure Boot.
• Windows Secure Kernel Mode.
• Windows Security Center.
• Windows SmartScreen.
• Windows App Installer.
• Windows Scripting.

The vulnerabilities cover several types. These are Spoofing, Denial of Service (DoS), Elevation of Privilege (EoP), Cross-site Scripting (XSS), Information Disclosure and Security Feature Bypass. The most severe type is Remote Code Execution (RCE).

Zero-Day Vulnerabilities Demand Immediate Attention

Six zero-day vulnerabilities are actively exploited. Three more are publicly disclosed zero-days (CVE-2024-21302, CVE-2024-38202, and CVE-2024-38199). Together they pose a major threat to firms and people. A tenth publicly disclosed zero-day vulnerability (CVE-2024-38200) has no patch from Microsoft yet. This adds to the risk.

Key Zero-Day Vulnerabilities

The following actively exploited zero-day vulnerabilities were addressed in this Patch Tuesday release:

• CVE-2024-38178: Scripting Engine Memory Corruption Vulnerability
  An attacker can exploit it by getting an authenticated user to visit a crafted URL. This leads to memory corruption in the scripting engine and possibly code execution.

• CVE-2024-38193: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
  This flaw lets attackers gain SYSTEM privileges. They target a kernel entry point in the Windows Ancillary Function Driver (AFD) for WinSock. This is a major security risk because it can give deep access.

• CVE-2024-38213: Windows SmartScreen Security Feature Bypass Vulnerability
  This vulnerability lets attackers bypass Windows SmartScreen. SmartScreen protects users from harmful websites and downloads. An attacker tricks a user into opening a harmful file. This gets around SmartScreen and leads to further attacks.

• CVE-2024-38106: Windows Kernel Elevation of Privilege Vulnerability
  This vulnerability involves a race condition in the Windows kernel. Attackers can use it to gain SYSTEM privileges. The kernel is the core of the OS, so a working attack could affect the whole system.

• CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability
  Attackers can exploit this vulnerability in Microsoft Project through email or web attacks. If a user is tricked into opening a harmful file, this can lead to remote code execution.

• CVE-2024-38107: Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
  This flaw is in the Power Dependency Coordinator part of Modern Standby. It could let attackers gain SYSTEM privileges. This is a major risk to affected systems.

CISA’s Response and Recommendations

In response, the Cybersecurity and Infrastructure Security Agency (CISA) has added the actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog. CISA requires federal agencies to patch these vulnerabilities by September 3, 2024.

Recommendation: All users and firms should patch these vulnerabilities at once. This lowers the risk and protects their systems.

2024 Q2

Microsoft June 2024 Patch Tuesday Fixes 51 Flaws, Including 18 RCEs

Published: 12 June 2024.

Yesterday was Microsoft June 2024 Patch Tuesday. It brings security updates for 51 flaws. These include eighteen remote code execution (RCE) flaws and one publicly disclosed zero-day vulnerability.

Key Fixes in This Update

• Critical Vulnerability: This Patch Tuesday fixed 18 RCE flaws but only one critical vulnerability. It is a remote code execution vulnerability in Microsoft Message Queuing (MSMQ).

Breakdown of Vulnerabilities

• 25 Elevation of Privilege Vulnerabilities.
• 18 Remote Code Execution Vulnerabilities.
• 3 Information Disclosure Vulnerabilities.
• 5 Denial of Service Vulnerabilities.

(Note: The total count of 51 flaws does not include the 7 Microsoft Edge flaws fixed on June 3rd.).

Publicly Disclosed Zero-Day

This month’s Patch Tuesday fixes one publicly disclosed zero-day vulnerability. No actively exploited flaw was fixed today. Microsoft calls a flaw a zero-day when it is publicly disclosed or actively exploited and has no official fix.

The publicly disclosed zero-day vulnerability is the ‘Keytrap’ attack in the DNS protocol. It was disclosed before. Microsoft has now fixed it in today’s updates.

• CVE-2023-50868:
  • Description: NSEC3, the closest encloser proof, can exhaust CPU.
  • Impact: Attackers could exploit this vulnerability in DNSSEC validation to use up resources on a resolver. This causes a denial of service for real users.
  • History: This flaw was disclosed before, in February. Many DNS implementations patched it, including BIND, PowerDNS, Unbound, Knot Resolver, and Dnsmasq.

Other Notable Fixes

• Microsoft Office: Many remote code execution flaws, including some in Microsoft Outlook, that attackers can use from the preview pane.
• Windows Kernel: Seven privilege elevation flaws that could let a local attacker gain SYSTEM privileges.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.

Recent Updates from Other Companies

Other vendors also released updates or advisories in June 2024:

• Apple: Fixed 21 security flaws in the visionOS 1.2 release.
• ARM: Fixed an actively exploited bug in Mali GPU kernel drivers.
• Cisco: Released security updates for Cisco Finesse and Webex.
• Cox: Fixed an API authentication bypass bug that hit millions of modems.
• F5: Released security updates for two high-severity flaws in the BIG-IP Next Central Manager API.
• PHP: Fixed a critical RCE flaw actively exploited in ransomware attacks.
• TikTok: Fixed an exploited zero-day, zero-click flaw in their direct messages feature.
• VMware: Fixed three zero-day bugs exploited at Pwn2Own 2024.
• Zyxel: Released an emergency RCE patch for end-of-life NAS devices.

2023 Q2

Microsoft Patch Tuesday: June 2023

Published: 14 June 2023.

Six Critical Vulnerabilities, No 0-day

Microsoft Patch Tuesday, the company’s monthly security update, has provided fixes for 70 vulnerabilities. Of these, 62 are rated as important, six as critical, one as moderate, and one as low.

These fixes cover some software, including Microsoft Office, Microsoft SharePoint, and Windows operating system parts. Critical vulnerabilities addressed include:

• CVE-2023-29357 in SharePoint Server 2019.
• CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015 in the Windows operating system’s rollout of Pragmatic General Multicast (PGM).

CVE-2023-29357: The Elevation of Privilege vulnerability in Microsoft SharePoint Server 2019 has a CVSSv3 severity score of 9.8 and is labeled critical. An unauthenticated, remote attacker can exploit this vulnerability. The attacker sends a spoofed JWT authentication token to the target server. This gives the attacker the privileges of an authenticated user on that system.

CVE-2023—29363 / 32014 / 32015: These are Remote Code Execution (RCE) vulnerabilities in Windows Pragmatic General Multicast (PGM). They have a critical severity rating of 9.8. An attacker who exploits these vulnerabilities could run any code on the target system with SYSTEM privileges.

The Elevation of Privilege (EoP) vulnerability CVE-2023-29357 in SharePoint Server 2019 was reportedly used in a chained attack demo. This took place at the March Pwn2Own Vancouver contest. The vulnerability lets an unauthenticated, remote attacker gain the privileges of an authenticated user. The attacker sends a spoofed JWT authentication token.

Microsoft advises users to enable AMSI as a fix. No one has tested if this works yet.

Similarly, the Remote Code Execution (RCE) vulnerabilities in the Windows operating system’s PGM, CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015, could let an attacker run code remotely. The attacker only needs to send a harmful file to a vulnerable system. These vulnerabilities are only exploitable on systems with message queueing services enabled.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in some Microsoft Exchange Server versions. They let an authenticated attacker run any code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in some Microsoft Exchange Server versions. They let an authenticated attacker run any code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Also, CVE-2023-29362 is an RCE vulnerability in the Remote Desktop Client part of Windows operating systems. It also affects the Remote Desktop Client for Windows Desktop apps. A remote attacker with control over a Remote Desktop Server can exploit it.

Microsoft urges all users to apply the Patch Tuesday updates now. This protects their systems against these vulnerabilities. As always, keeping software updated with the latest security patches is one of the best ways to stay safe.

Updates ASAP

In March 2023, Microsoft released 2 zero-days in its Patch Tuesday updates. After that, in BRANDEFENSE Analysts’ investigation, threat actors posted about CVE-2023-24880 on a dark web forum. In the forum post, threat actors said that not all Windows systems had been updated yet. So they could keep sharing the PoC. [Read More].

Threat actors always wait for your mistakes. Do not forget your updates.

2023 Q1

Microsoft Fixes Multiple Vulnerabilities In March 2023 Patch Tuesday Updates

Published: 21 March 2023.

Microsoft has released its March 2023 Patch Tuesday software updates, which include two zero-days. The first vulnerability is an information disclosure issue. A remote attacker can send crafted email messages to a victim’s inbox. This makes Windows Mail or Outlook crash and restart. The attacker then gets the NTLMv2 hash of the victim’s account.

The second vulnerability needs the hash first. An attacker may get it through other means (such as phishing). Or the attacker may use another exploit like EternalBlue, DoublePulsar, or EternalSynergy. Microsoft fixed all of these in February. With the hash, the attacker can reach any user’s mailbox on an Exchange server running Outlook Web Access (OWA).

CVE-2023-23397

Microsoft has patched a critical elevation of privilege vulnerability in Windows. Russian hackers and ransomware actors exploited it.

The CVE-2023-23397 vulnerability lets attackers run code with elevated privileges on targeted systems. Strontium (aka APT28), Sednit, Sofacy and Fancy Bear used it. They attacked government, transportation, and energy sectors in Europe.

Microsoft gave no further details about this flaw. It said it knew of limited, targeted attacks abusing the bug before it released its patches last week.

CVE-2023-24880

Microsoft has released a patch for a zero-day vulnerability. The Magniber ransomware operation exploited it. CVE-2023-24880 is a SmartScreen security feature bypass. Magniber used it to trick users into downloading harmful MSI files. The vulnerability affected all versions of Windows 10, 8, 7, and Vista operating systems. This ran from January 2023 to the present day.

Microsoft said that over 100 000 downloads of harmful MSI files had been detected since January 2023. The company also noted that so far these exploits appear only in Magniber’s operations. Some reports mention an unnamed actor abusing this same vulnerability.

The products and versions affected by the said vulnerabilities are listed below.

• Microsoft ICMP (MS18-11).
• Microsoft Excel (MS18-10).
• Microsoft IIS (MS18-09).
• Windows Cryptographic Services (MS18-08).

Exploitation Details

Microsoft has released a patch to fix the vulnerabilities. The company says it has not seen any attacks in the wild. Security experts have been able to exploit these flaws in lab environments.

In the attack scenario, an attacker sends users a phishing email. It contains a harmful attachment or link. When the victim clicks it, harmful code downloads from an attacker-controlled server. The code runs locally on their computer. This code can then get NTLMv2 hashes in one of two ways. One is through the Net-NTLMv2 hash of the Windows account.

The other is through an NTLM Relay attack against another service (such as RDP). Once gained, attackers can use these hashes to log in to other services without credentials. Examples are SharePoint Server 2016 or Exchange Server 2016 running on Microsoft Windows Server 2012 R2 or earlier versions.

Prevention

• Keep Your Software Up-To-Date.
• Use Strong Authentication Methods.
• Use Secure Email Practices, Like S/MIME Encryption And Two-Factor Authentication (2FA).

Update

According to BRANDEFENSE Analysts’ investigation, threat actors posted about CVE-2023-24880 on a dark web forum. In the forum post, threat actors said that not all Windows systems had been updated yet. So they could keep sharing the PoC.