Microsoft January 2024 Patch Tuesday fixes 49 flaws, 12 RCE bugs

At this time is Microsoft’s January 2024 Patch Tuesday, which incorporates security updates for a complete of 49 flaws and 12 distant code execution vulnerabilities.

Solely two vulnerabilities have been categorized as crucial, with one being a Home windows Kerberos Safety Function Bypass and the opposite a Hyper-V RCE. 

The variety of bugs in every vulnerability class is listed beneath:

• 10 Elevation of Privilege Vulnerabilities
• 7 Safety Function Bypass Vulnerabilities
• 12 Distant Code Execution Vulnerabilities
• 11 Info Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities 

The whole depend of 49 flaws doesn’t embody 4 Microsoft Edge flaws mounted on January fifth.

To be taught extra in regards to the non-security updates launched as we speak, you’ll be able to evaluation our devoted articles on the brand new Home windows 11 KB5034123 cumulative replace and Home windows 10 KB5034122 replace.

This month’s fascinating flaws

Whereas there have been no actively exploited or publicly disclosed vulnerabilities this month, some flaws are extra fascinating than others.

Microsoft fixes an Workplace Distant Code Execution Vulnerability tracked as CVE-2024-20677 that enables risk actors to create maliciously crafted Workplace paperwork with embedded FBX 3D mannequin recordsdata to carry out distant code execution.

“A security vulnerability exists in FBX that would result in distant code execution. To mitigate this vulnerability, the power to insert FBX recordsdata has been disabled in Phrase, Excel, PowerPoint and Outlook for Home windows and Mac,” explains Microsoft security bulletin.

“Variations of Workplace that had this function enabled will not have entry to it. This contains Workplace 2019, Workplace 2021, Workplace LTSC for Mac 2021, and Microsoft 365.”

“3D fashions in Workplace paperwork that have been beforehand inserted from a FBX file will proceed to work as anticipated except the Hyperlink to File possibility was chosen at insert time.”

A crucial Home windows Kerberos bug tracked as CVE-2024-20674 was additionally mounted as we speak, permitting an attacker to bypass the authentication function.

“An unauthenticated attacker may exploit this vulnerability by establishing a machine-in-the-middle (MITM) assault or different native community spoofing method, then sending a malicious Kerberos message to the consumer sufferer machine to spoof itself because the Kerberos authentication server,” reads a assist bulletin.

Current updates from different corporations

Different distributors who launched updates or advisories in January 2023 embody:

The January 2024 Patch Tuesday Safety Updates

Beneath is the entire listing of resolved vulnerabilities within the January 2023 Patch Tuesday updates.

To entry the complete description of every vulnerability and the techniques it impacts, you’ll be able to view the complete report right here.