Microsoft Fixes Five Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-20659 | Windows Hyper-V Security Feature Bypass Vulnerability Windows Hyper-V Security Feature Bypass Vulnerability NVD description · AI analysis pending | 7.1 | <1% |
| — | ||
| CVE-2024-43573 +1 in the same advisory: …43572 | Spoofing Vulnerability in Microsoft Windows MSHTML Platform Exploited in the Wild CVE-2024-43573 is a spoofing vulnerability in the Microsoft Windows MSHTML platform, classified as an input-neutralization flaw (CWE-79), that can lead to a loss of confidentiality. It is triggered when a user renders attacker-crafted content through the MSHTML engine, the browser-rendering component embedded in Windows that many system surfaces and applications use to display web-like content, causing content or interface elements to appear to come from a trusted source when they are attacker-controlled. An attacker who successfully exploits it can present spoofed content or prompts that deceive users, potentially leading them to reveal sensitive information such as credentials. All Microsoft Windows systems are affected according to CISA's listing, though no specific version breakdown is provided in the source data. The flaw is confirmed to be exploited in the wild (CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-08), EPSS assigns a 44.1% probability of exploitation in the next 30 days (99th percentile), no public PoC is known, and any ransomware association is listed as unknown. Do: Apply Microsoft's October 2024 security updates (or later cumulative updates) to all Windows clients and servers as soon as possible, following vendor instructions; per CISA's required action, apply vendor mitigations or discontinue use of the affected platform if mitigations are unavailable. Until patched, exercise caution with unsolicited documents, links, and content rendered through Windows surfaces, and watch for spoofed prompts or user-interface elements. Federal agencies should complete remediation by the KEV due date for this entry. | 8.1 group max | 44% | KEV |
| mass≈1 billion+ Windows installations worldwide (MSHTML is present on essentially every Windows client and server) | |
| CVE-2024-43583 | Winlogon Elevation of Privilege Vulnerability Winlogon Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 | 1% |
| — | ||
| CVE-2024-6197 | libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances. NVD description · AI analysis pending | 7.5 | 4% | PoC |
| — |
Full article389 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft has patched two zero-day bugs under active exploitation and a further three that were publicly disclosed in this month’s Patch Tuesday update round.
CVE-2024-43572 is a remote code execution (RCE) vulnerability in the Microsoft Management Console with a CVSS score of 7.8.
It’s unclear how it has been exploited in the wild, but threat actors could pair it with phishing, privilege escalation or network propagation attacks to achieve data exfiltration, lateral movement, system compromise and deployment of backdoors, according to Action1 president, Mike Walters.
“Given the widespread use of Windows-based systems in corporate and government settings, CVE-2024-43572 poses a considerable risk,” he warned.
“It’s estimated that millions of endpoints, particularly those in organizations using MMC for administrative tasks and policy enforcement, are vulnerable – especially those that have not installed the necessary security update to block execution from untrusted MSC files. This threat is especially acute in environments with less technically aware end-users or extensive digital footprints.”
Read more on Patch Tuesday: Microsoft Fixes Four Zero-Days in July Patch Tuesday
A second exploited zero-day, CVE-2024-43573, is a Windows MSHTML platform spoofing vulnerability, which enables threat actors to trick users into believing they are visiting a legitimate site in order to harvest information or inject malicious payloads.
Although it only has a CVSS score of 6.5, it could lead to a “significant” risk of phishing or data compromise, according to Walters.
“Given the extensive use of MSHTML within Windows environments and its integration into various web-centric applications, a significant number of enterprises, especially those in sectors like finance and e-commerce that rely heavily on web interactions, are potentially at risk,” he added.
“Organizations with less robust perimeter defenses are particularly vulnerable to these threats.”
Three More Zero-Days Not Yet Exploited
The publicly disclosed zero-days patched yesterday which have yet to be exploited are:
- CVE-2024-6197: An open source Curl RCE vulnerability, which has a CVSS score of 8.8 and could enable man-in-the-middle attacks
- CVE-2024-43583: A Winlogon elevation-of-privilege bug, which could grant a threat actor admin rights to access a target network
- CVE-2024-20659: A Windows Hyper-V security feature bypass vulnerability, which could allow attackers to compromise the hypervisor and kernel, although they’d need physical access to a device and to reboot it
In total, Microsoft addressed 118 CVEs yesterday, the third-highest number in the past year.
Image credit: CHERRY.JUICE / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-five-zerodays-patch/