Microsoft has addressed a complete of 48 security flaws spanning its software program as a part of its Patch Tuesday updates for January 2024.
Of the 48 bugs, two are rated Vital and 46 are rated Essential in severity. There is no such thing as a proof that any of the problems are publicly identified or underneath energetic assault on the time of launch, making it the second consecutive Patch Tuesday with no zero-days.
The fixes are along with 9 security vulnerabilities which have been resolved within the Chromium-based Edge browser because the launch of December 2023 Patch Tuesday updates. This additionally features a repair for a zero-day (CVE-2023-7024, CVSS rating: 8.8) that Google mentioned has been actively exploited within the wild.
Probably the most vital amongst flaws patched this month are as follows –
- CVE-2024-20674 (CVSS rating: 9.0) – Home windows Kerberos Safety Function Bypass Vulnerability
- CVE-2024-20700 (CVSS rating: 7.5) – Home windows Hyper-V Distant Code Execution Vulnerability
“The authentication function could possibly be bypassed as this vulnerability permits impersonation,” Microsoft mentioned in an advisory for CVE-2024-20674.
“An authenticated attacker may exploit this vulnerability by establishing a machine-in-the-middle (MitM) assault or different native community spoofing method, then sending a malicious Kerberos message to the shopper sufferer machine to spoof itself because the Kerberos authentication server.”
Nevertheless, the corporate famous that profitable exploitation requires an attacker to realize entry to the restricted community first. Safety researcher ldwilmore34 has been credited with discovering and reporting the flaw.
CVE-2024-20700, however, neither requires authentication nor person interplay to realize distant code execution, though successful a race situation is a prerequisite to staging an assault.
“It is not clear precisely the place the attacker should be situated — the LAN on which the hypervisor resides, or a digital community created and managed by the hypervisor — or in what context the distant code execution would happen,” Adam Barnett, lead software program engineer at Rapid7, advised The Hacker Information.
Different notable flaws embrace CVE-2024-20653 (CVSS rating: 7.8), a privilege escalation flaw impacting the Frequent Log File System (CLFS) driver, and CVE-2024-0056 (CVSS rating: 8.7), a security bypass affecting System.Data.SqlClient and Microsoft.Data.SqlClient.
“An attacker who efficiently exploited this vulnerability may perform a machine-in-the-middle (MitM) assault and will decrypt and skim or modify TLS site visitors between the shopper and server,” Redmond mentioned.
Microsoft additional famous that it is disabling the power to insert FBX information in Phrase, Excel, PowerPoint, and Outlook in Home windows by default attributable to a security flaw (CVE-2024-20677, CVSS rating: 7.8) that might result in distant code execution.
“3D fashions in Workplace paperwork that have been beforehand inserted from an FBX file will proceed to work as anticipated until the ‘Hyperlink to File’ possibility was chosen on the insert time,” Microsoft mentioned in a separate alert. “GLB (Binary GL Transmission Format) is the really helpful substitute 3D file format to be used in Workplace.”
It is value noting that Microsoft took the same step of disabling the SketchUp (SKP) file format in Workplace following ZScaler’s discovery of 117 security flaws in Microsoft 365 functions.
Software program Patches from Different Distributors
Along with Microsoft, security updates have additionally been launched by different distributors over the previous few weeks to rectify a number of vulnerabilities, together with –
