Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 91 flaws

As we speak is Microsoft’s November 2024 Patch Tuesday, which incorporates security updates for 91 flaws, together with 4 zero-days, two of that are actively exploited.

This Patch Tuesday fastened 4 vital vulnerabilities, which embody two distant code execution and two elevation of privileges flaws.

The variety of bugs in every vulnerability class is listed beneath:

• 26 Elevation of Privilege vulnerabilities
• 2 Safety Function Bypass vulnerabilities
• 52 Distant Code Execution vulnerabilities
• 1 Data Disclosure vulnerability
• 4 Denial of Service vulnerabilities
• 3 Spoofing vulnerabilities

This depend doesn’t embody two Edge flaws that had been beforehand fastened on November seventh.

To be taught extra concerning the non-security updates launched at this time, you’ll be able to evaluate our devoted articles on the brand new Home windows 11 KB5046617 and KB5046633 cumulative updates and the Home windows 10 KB5046613 replace.

4 zero-days disclosed

This month’s Patch Tuesday fixes 4 zero-days, two of which had been actively exploited in assaults, and three had been publicly disclosed.

Microsoft classifies a zero-day flaw as one that’s publicly disclosed or actively exploited whereas no official repair is obtainable.

The 2 actively exploited zero-day vulnerabilities in at this time’s updates are:

CVE-2024-43451 – NTLM Hash Disclosure Spoofing Vulnerability

Microsoft has fastened a vulnerability that exposes NTLM hashes to distant attackers with minimal interplay with a malicious file.

“This vulnerability discloses a person’s NTLMv2 hash to the attacker who may use this to authenticate because the person,” defined Microsoft.

“Minimal interplay with a malicious file by a person similar to deciding on (single-click), inspecting (right-click), or performing an motion aside from opening or executing may set off this vulnerability,” continued Microsoft.

Microsoft says Israel Yeshurun of ClearSky Cyber Safety found this vulnerability and that it was publicly disclosed, however didn’t share any additional particulars.

CVE-2024-49039 – Home windows Process Scheduler Elevation of Privilege Vulnerability

A specifically crafted utility may very well be executed that elevates privilege to Medium Integrity stage.

“On this case, a profitable assault may very well be carried out from a low privilege AppContainer. The attacker may elevate their privileges and execute code or entry assets at a better integrity stage than that of the AppContainer execution setting,” defined Microsoft.

Microsoft says that exploiting this vulnerability would enable attackers to execute RPC capabilities which might be usually restricted to privileged accounts.

The flaw was found by Vlad Stolyarov and Bahare Sabouri of Google’s Risk Evaluation Group.

It’s not identified how the flaw was exploited in assaults.

The opposite three vulnerabilities that had been publicly disclosed however not exploited in assaults are:

CVE-2024-49040 – Microsoft Alternate Server Spoofing Vulnerability

Microsoft has fastened a Microsoft Alternate vulnerability that permits risk actors to spoof the sender’s electronic mail deal with in emails to native recipients.

“Microsoft is conscious of a vulnerability (CVE-2024-49040) that permits attackers to run spoofing assaults in opposition to Microsoft Alternate Server,” explains a associated advisory by Microsoft.

“The vulnerability is attributable to the present implementation of the P2 FROM header verification, which occurs in transport.”

Beginning with this month’s Microsoft Alternate security updates, Microsoft is now detecting and flagging spoofed emails with an alert prepended to the e-mail physique that states, “Discover: This electronic mail seems to be suspicious. Don’t belief the knowledge, hyperlinks, or attachments on this electronic mail with out verifying the supply by means of a trusted technique.”

Microsoft says the flaw was found by Slonser at Solidlab, who publicly disclosed the flaw on this article.

CVE-2024-49019 – Energetic Listing Certificates Providers Elevation of Privilege Vulnerability

Microsoft fastened a flaw that permits attackers to realize area administrator privileges by abusing built-in default model 1 certificates templates.

“Verify if in case you have printed any certificates created utilizing a model 1 certificates template the place the Supply of topic identify is about to “Provided within the request” and the Enroll permissions are granted to a broader set of accounts, similar to area customers or area computer systems,” explains Microsoft.

“An instance is the built-in Net Server template, however it’s not weak by default on account of its restricted Enroll permissions.”

The flaw was found by Lou Scicchitano, Scot Berner, and Justin Bollinger with TrustedSec, who disclosed the “EKUwu” vulnerability in October.

“Utilizing built-in default model 1 certificates templates, an attacker can craft a CSR to incorporate utility insurance policies which might be most well-liked over the configured Prolonged Key Utilization attributes specified within the template,” reads TrustedSec’s report.

“The one requirement is enrollment rights, and it may be used to generate shopper authentication, certificates request agent, and codesigning certificates utilizing the WebServer template.”

As defined above, CVE-2024-43451 was additionally publicly disclosed.

Latest updates from different corporations

Different distributors who launched updates or advisories in November 2024 embody:

• Adobe launched security updates for quite a few purposes, together with Photoshop, Illustrator, and Commerce.
• Cisco releases security updates for a number of merchandise, together with Cisco Telephones, Nexus Dashboard, Id Providers Engine, and extra.
• Citrix releases security updates for NetScaler ADC and NetScaler Gateway vulnerabilities. Additionally they launched an replace for the Citrix Digital Apps and Desktops reported by Watchtowr.
• Dell releases security updates for code execution and security bypass flaws in SONiC OS.
• D-Hyperlink releases a security replace for a vital DSL6740C flaw that permits modification of account passwords.
• Google launched Chrome 131, which incorporates 12 security fixes. No zero-days.
• Ivanti releases security updates for twenty-five vulnerabilities in Ivanti Join Safe (ICS), Ivanti Coverage Safe (IPS), Ivanti Safe Entry Consumer (ISAC).
• SAP releases security updates for a number of merchandise as a part of November Patch Day.
• Schneider Electrical releases security updates for flaws in Modicon M340, Momentum, and MC80 merchandise.
• Siemens launched a security replace for a vital 10/10 flaw in TeleControl Server Fundamental tracked as CVE-2024-44102.

The November 2024 Patch Tuesday Safety Updates

Beneath is the whole record of resolved vulnerabilities within the November 2024 Patch Tuesday updates.

To entry the complete description of every vulnerability and the techniques it impacts, you’ll be able to view the full report right here.

Replace 9/11/24: Up to date to elucidate that solely three flaws had been actively exploited and why CVE-2024-43491 was marked as exploited.