Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws

Right this moment is Microsoft’s October 2024 Patch Tuesday, which incorporates security updates for 118 flaws, together with 5 publicly disclosed zero-days, two of that are actively exploited.

This Patch Tuesday mounted three essential vulnerabilities, all distant code execution flaws.

The variety of bugs in every vulnerability class is listed beneath:

• 28 Elevation of Privilege vulnerabilities
• 7 Safety Function Bypass vulnerabilities
• 43 Distant Code Execution vulnerabilities
• 6 Data Disclosure vulnerabilities
• 26 Denial of Service vulnerabilities
• 7 Spoofing vulnerabilities

This rely doesn’t embody three Edge flaws that had been beforehand mounted on October third.

To be taught extra in regards to the non-security updates launched right this moment, you’ll be able to evaluation our devoted articles on the brand new Home windows 11 KB5044284 and KB5044285 cumulative updates and the Home windows 10 KB5044273 replace.

4 zero-days disclosed

This month’s Patch Tuesday fixes 5 zero-days, two of which had been actively exploited in assaults, and all 5 had been publicly disclosed.

Microsoft classifies a zero-day flaw as one that’s publicly disclosed or actively exploited whereas no official repair is out there.

The 2 actively exploited zero-day vulnerabilities in right this moment’s updates are:

CVE-2024-43573 – Home windows MSHTML Platform Spoofing Vulnerability

Whereas Microsoft has not shared any detailed details about this bug or the way it’s exploited, they did state it concerned the MSHTML platform, beforehand utilized by Web Explorer and Legacy Microsoft Edge, whose elements are nonetheless put in in Home windows.

“Whereas Microsoft has introduced retirement of the Web Explorer 11 utility on sure platforms and the Microsoft Edge Legacy utility is deprecated, the underlying MSHTML, EdgeHTML, and scripting platforms are nonetheless supported,” defined Microsoft.

“The MSHTML platform is utilized by Web Explorer mode in Microsoft Edge in addition to different purposes by means of WebBrowser management. The EdgeHTML platform is utilized by WebView and a few UWP purposes. The scripting platforms are utilized by MSHTML and EdgeHTML however will also be utilized by different legacy purposes.”

Whereas not confirmed, this could possibly be a bypass of a earlier vulnerability that abused MSHTML to spoof file extensions in alerts displayed when opening information. The same MSHTML spoofing flaw was disclosed final month when assaults utilized Braille characters in filenames to spoof PDF information.

Microsoft has not shared who disclosed the vulnerability.

CVE-2024-43572 – Microsoft Administration Console Distant Code Execution Vulnerability

This flaw allowed malicious Microsoft Saved Console (MSC) information to carry out distant code execution on susceptible gadgets.

Microsoft mounted the flaw by stopping untrusted MSC information from being opened.

“The security replace will stop untrusted Microsoft Saved Console (MSC) information from being opened to guard clients towards the dangers related to this vulnerability,” defined Microsoft.

It’s unknown how this flaw was actively exploited in assaults. 

Microsoft says the bug was disclosed by “Andres and Shady”.

Microsoft says that each of those had been additionally publicly disclosed.

The opposite three vulnerabilities that had been publicly disclosed however not exploited in assaults are:

CVE-2024-6197 – Open Supply Curl Distant Code Execution Vulnerability

Microsoft mounted a libcurl distant code execution flaw that would trigger instructions to be executed when Curl makes an attempt to hook up with a malicious server.

“The susceptible code path could be triggered by a malicious server providing an particularly crafted TLS certificates,” explains a Curl security advisory.

Microsoft mounted the flaw by updating the libcurl library utilized by the Curl executable bundled with Home windows.

The flaw was found by a security researcher named “z2_,” who shared technical particulars in a HackerOne report.

CVE-2024-20659 – Home windows Hyper-V Safety Function Bypass Vulnerability

Microsoft mounted a UEFI bypass that would permit attackers to compromised the hypervisor and kernel.

“This Hypervisor vulnerability pertains to Digital Machines inside a Unified Extensible Firmware Interface (UEFI) host machine,” explains Microsoft.

“On some particular {hardware} it could be attainable to bypass the UEFI, which might result in the compromise of the hypervisor and the safe kernel.”

Microsoft says that an attacker wants bodily entry to the machine and should reboot it to use the flaw.

The flaw was found by Francisco Falcón and Iván Arce of Quarkslab however it isn’t recognized the place it was publicly disclosed.

CVE-2024-43583 – Winlogon Elevation of Privilege Vulnerability

Microsoft mounted an elevation of privileges flaw that would give attackers SYSTEM privileges in Home windows.

To be protected against this flaw, Microsoft says that admins should take further actions.

“To deal with this vulnerability, be sure that a Microsoft first-party IME is enabled in your machine,” explains Microsoft.

“By doing so, you’ll be able to assist shield your machine from potential vulnerabilities related to a third-party (3P) IME through the check in course of.”

Microsoft says wh1tc & Zhiniang Peng of pwnull found the issues.

Current updates from different firms

Different distributors who launched updates or advisories in October 2024 embody:

The October 2024 Patch Tuesday Safety Updates

Under is the entire record of resolved vulnerabilities within the October 2024 Patch Tuesday updates.

To entry the complete description of every vulnerability and the techniques it impacts, you’ll be able to view the full report right here.

Replace 9/11/24: Up to date to clarify that solely three flaws had been actively exploited and why CVE-2024-43491 was marked as exploited.