Microsoft Patch Tuesday for January 2025 — Snort rules and prominent vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-21298 | Use-After-Free RCE in Windows OLE (CVE-2025-21298) CVE-2025-21298 is a use-after-free (CWE-416) vulnerability in the Windows OLE (Object Linking and Embedding) component that permits remote code execution. According to the published CVSS vector, it is network-exploitable without privileges or user interaction, triggered when the system processes maliciously crafted OLE content. A successful attacker gains arbitrary code execution in the context of the affected process, with high impact on confidentiality, integrity, and availability. The flaw affects nearly the entire supported Windows estate — Windows 10 1507 through 22H2, Windows 11 22H2 through 24H2, and Windows Server 2008 through 2019. As of the January 2025 Patch Tuesday release there is no known public proof-of-concept or confirmed in-the-wild exploitation, but the EPSS score of 80.9% (100th percentile) indicates a very high probability of exploitation within 30 days. Do: Apply Microsoft's January 2025 Windows cumulative security updates to all affected Windows 10/11 and Windows Server hosts immediately, prioritizing internet-facing and server systems given the network-exploitable, critical rating. Verify via patch-reporting tools that the OLE update is present on each host; no vendor mitigations were noted in the available data, so updating is the primary defense. Although no exploitation is confirmed yet, the 80.9% EPSS score argues for completing remediation before a PoC or in-the-wild exploitation emerges. | 9.8 group max | 81% |
| mass≈1 billion+ Windows installations (essentially the entire supported Windows client and Server estate) | ||
| CVE-2025-21292 | Windows Search Service Elevation of Privilege Vulnerability Windows Search Service Elevation of Privilege Vulnerability NVD description · AI analysis pending | 8.8 | <1% |
| — | ||
| CVE-2025-21297 | Windows Remote Desktop Services Remote Code Execution Vulnerability Windows Remote Desktop Services Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.1 | 1% |
| — | ||
| CVE-2025-21309 | Windows Remote Desktop Services Remote Code Execution Vulnerability Windows Remote Desktop Services Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.1 | 15% |
| — | ||
| CVE-2025-21311 +1 in the same advisory: …21315 | Windows NTLM V1 Elevation of Privilege Vulnerability Windows NTLM V1 Elevation of Privilege Vulnerability NVD description · AI analysis pending | 9.8 group max | 2% |
| — | ||
| CVE-2025-21314 | Windows SmartScreen Spoofing Vulnerability Windows SmartScreen Spoofing Vulnerability NVD description · AI analysis pending | 6.5 | 1% |
| — | ||
| CVE-2025-21362 | Microsoft Excel Remote Code Execution Vulnerability Microsoft Excel Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.4 group max | <1% |
| — | ||
| CVE-2025-21380 | Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network. Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network. NVD description · AI analysis pending | 6.5 | 2% |
| — | ||
| CVE-2025-21385 | Authenticated SSRF in Microsoft Purview Enables Information Disclosure CVE-2025-21385 is a server-side request forgery (SSRF, CWE-918) flaw in Microsoft Purview that lets an authorized, low-privilege user cause the service to make network requests to attacker-influenced or internal endpoints. It is triggered over the network by an authenticated account with no user interaction required, so any tenant user with basic access to the affected Purview functionality is a potential trigger. Successful exploitation has a high confidentiality impact: the attacker can read information from internal resources reachable by the service, without modifying data or disrupting availability. Organizations using the affected Microsoft Purview components are potentially exposed; Microsoft's published data does not specify version ranges or the vulnerable component. No in-the-wild exploitation or public proof-of-concept is known, but the ~24% EPSS score (98th percentile) indicates a high predicted likelihood of exploitation within 30 days. Do: Because Microsoft Purview is primarily a cloud service, confirm your tenant has received Microsoft's January 2025 Patch Tuesday service updates and review Microsoft's advisory for any on-prem Purview components (e.g., Information Protection scanner) that need updating. Limit which low-privilege accounts can invoke network requests in Purview, audit the service for unusual outbound or internal requests, and prioritize monitoring given the elevated ~24% 30-day exploitation probability. | 6.5 | 24% |
| masslikely millions of enterprise users across Microsoft 365 tenants using Purview (exact count unknown) |
Full article842 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, January 14, 2025 16:15
Microsoft has released its monthly security update for January of 2025 which includes 159 vulnerabilities, including 12 that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.”
One notable critically rated vulnerability that has been patched this month is CVE-2025-21309, which is a remote code execution vulnerability affecting Windows Remote Desktop Services. Exploitation of this vulnerability could lead to arbitrary code execution on systems where the Remote Desktop Gateway role has been enabled. This vulnerability has been assigned a CVSS 3.1 score of 8.1 and is considered “more likely to be exploited” by Microsoft.
Another notable remote code execution vulnerability in Window Object Linking and Embedding (OLE) was also patched this month. This vulnerability, CVE-2025-21298, is a critical remotely exploitable vulnerability that can be triggered by sending a malicious email to a victim running a vulnerable version of Microsoft Outlook. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on vulnerable systems and can be triggered when the victim previews the malicious email. This vulnerability has been assigned a CVSS 3.1 score of 9.8. Microsoft recommends disabling RTF as mitigation for this vulnerability.
CVE-2025-21294 is a critical vulnerability in Microsoft Digest Authentication that affects multiple versions of Windows and Windows Server. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on vulnerable systems. To exploit this vulnerability, an attacker would need to win a race condition.
CVE-2025-21295 is a critical remote code execution vulnerability in SPNEGO Extended Negotiation (NEGOEX) Security Mechanism. This vulnerability could allow an attacker to execute arbitrary code on vulnerable systems and does not require user interaction for successful exploitation.
CVE-2025-21296 is a critical remote code execution vulnerability in BranchCache. This vulnerability could allow an attacker to execute arbitrary code on vulnerable systems. Microsoft assesses that an attacker would need to be on the same network to successfully exploit this vulnerability.
CVE-2025-21297 is another critical remote code execution vulnerability in Windows Remote Desktop Services. Microsoft has assessed that this vulnerability is “less likely to be exploited” and that it would require an attacker to win a race condition for exploitation to be successful. This vulnerability affects multiple versions of Windows Server.
CVE-2025-21298 is a critical remote code execution vulnerability in Windows Object Linking and Embedding (OLE). It could allow an attacker to execute arbitrary code on vulnerable systems. Microsoft recommends disabling RTF as a mitigation for this vulnerability.
CVE-2025-21307 is a critical remote code execution vulnerability in Windows Reliable Multicast Transport Driver (RMCAST). This vulnerability, if successfully exploited, could enable an unauthenticated attacker to execute arbitrary code by sending a specially crafted packet to vulnerable systems.
CVE-2025-21311 is a critical privilege escalation vulnerability in NTLMv1. This vulnerability can be exploited remotely and could allow an attacker to increase their level of access to vulnerable systems. Microsoft recommends disabling the use of NTLMv1 as a mitigation for this vulnerability.
CVE-2025-21362 - is a critical remote code execution vulnerability in Microsoft Excel. This vulnerability could allow an attacker to execute arbitrary code on vulnerable systems. This vulnerability can also be triggered via the preview pane.
CVE-2025-21380 is a critical information disclosure vulnerability affecting Azure Marketplace SaaS Resources. According to Microsoft this vulnerability, which could enable an attacker to disclose information, has been mitigated.
CVE-2025-21385 is a critical information disclosure vulnerability affecting Microsoft Purview. This vulnerability is due to a Server-Side Request Forgery (SSRF) vulnerability that Microsoft reports has been mitigated.
Talos would also like to highlight the following important vulnerabilities that Microsoft considers to be “more likely” to be exploited:
- CVE-2025-21189 - MapUrlToZone Security Feature Bypass Vulnerability
- CVE-2025-21210 - Windows BitLocker Information Disclosure Vulnerability
- CVE-2025-21219 - MapUrlToZone Security Feature Bypass Vulnerability
- CVE-2025-21268 - MapUrlToZone Security Feature Bypass Vulnerability
- CVE-2025-21269 - MapUrlToZone Security Feature Bypass Vulnerability
- CVE-2025-21292 - Windows Search Service Elevation of Privilege Vulnerability
- CVE-2025-21299 - Windows Kerberos Security Feature Bypass Vulnerability
- CVE-2025-21314 - Windows SmartScreen Spoofing Vulnerability
- CVE-2025-21315 - Microsoft Brokering File System Elevation of Privilege Vulnerability
- CVE-2025-21328 - MapUrlToZone Security Feature Bypass Vulnerability
- CVE-2025-21329 - MapUrlToZone Security Feature Bypass Vulnerability
- CVE-2025-21354 - Microsoft Excel Remote Code Execution Vulnerability
- CVE-2025-21364 - Microsoft Excel Security Feature Bypass Vulnerability
- CVE-2025-21365 - Microsoft Word Remote Code Execution Vulnerability
A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.
In response to these vulnerability disclosures, Talos is releasing a new Snort rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
The rules included in this release that protect against the exploitation of many of these vulnerabilities are 64432 – 64436, 64444 - 64457. There are also these Snort 3 rules: 301113, 301114, 301117 - 301123.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/january-patch-tuesday-release/