Microsoft Rolls Out Patches for 73 Flaws, Together with 2 Home windows 0-Days

Feb 14, 2024 NewsroomPatch Tuesday / Risk
Microsoft has launched patches to deal with 73 safety flaws that came about in its device as a part of its Patch Tuesday updates in February 2024, together with two zero-day exploits. Of the 73 threats, 5 have been rated Essential, 65 have been rated essential, and 3 have been rated daring. This comprises 24 insects which were mounted within the Chromium-Edge browser because the free up of the January 24 Patch Tuesday replace. The 2 vulnerabilities indexed as being attacked all the way through the discharge are indexed underneath – CVE-2024-21351 (CVSS rating: 7.6) – Home windows SmartScreen Safety Function Bypass Vulnerability CVE-2024-21412 (CVSS rating: 8.1) – Web Shortcut. Recordsdata Safety bypass Vulnerability “The vulnerability permits a malicious actor to inject code into SmartScreen and get right of entry to code, which might result in knowledge publicity, gadget failure, or each,” Microsoft stated about CVE-2024-21351. Exploiting the flaw may permit an attacker to circumvent SmartScreen coverage and run arbitrary code. On the other hand, for the assault to paintings, the attacker should ship the person a malicious record and persuade the person to open it. CVE-2024-21412, in a identical means, permits an unauthenticated attacker to circumvent safety tests through sending a specifically crafted record to a person. “On the other hand, the attacker won’t have a approach to pressure the person to view the content material managed through the attacker.” Redmond stated. “As an alternative, the attacker has to persuade them to do so through clicking at the record hyperlink.”

CVE-2024-21351 is the second one bypass trojan horse present in SmartScreen after CVE-2023-36025 (CVSS rating: 8.8), which used to be related to the era large in November 2023. expanding DarkGate, Phemedrone Stealer, and Mispadu. Development Micro, which reported on an assault marketing campaign performed through Water Hydra (aka DarkCasino) concentrated on monetary investors the use of the long-term CVE-2024-21412 way, described CVE-2024-21412 as a bypass way for CVE-2023 -36025, thus contributing to danger actors to circumvent SmartScreen tests. Water Hydra, which used to be first reported in 2021, has a historical past of launching assaults in opposition to banks, cryptocurrency platforms, buying and selling products and services, playing websites, and casinos to ship a trojan known as DarkMe the use of zero-day gear, together with the WinRAR trojan horse that used to be uncovered. August 2023 (CVE-2023-38831, CVSS rating: 7.8). On the finish of closing yr, the Chinese language cybersecurity corporate NSFOCUS graduated their “economically motivated” coaching into a brand new complicated danger evaluate (APT). “In January 2024, Water Hydra changed its anti-infection way the use of CVE-2024-21412 to create a malicious Microsoft Installer (.MSI) record, concentrated on the DarkMe an infection trail,” Development Micro stated. Either one of those vulnerabilities were added to the record of Identified Exploited Vulnerabilities (KEV) through the United States Cybersecurity and Infrastructure Safety Company (CISA), encouraging govt businesses to use the most recent updates through March 5, 2024. Different Microsoft patches additionally comprise insects best 5 – CVE-2024-20684 (CVSS rating: 6.5) – Home windows Hyper-V Denial of Provider Vulnerability CVE-2024-21357 (CVSS rating: 7.5) – Home windows Pragmatic Common Multicast (PGM) Far off Code Execution Vulnerability CVE-2024-21357 (CVSS rating: 7.5) 21380 (CVSS21380 rating: 8.0) – Microsoft Dynamics Trade Central/NAV Data Disclosure Vulnerability CVE-2024-21410 (CVSS rating: 9.8) – Microsoft Trade Server Elevation of Privilege Vulnerability CVE-2024-21413 (CVSS map: 9.8) – Microsoft Outlook Far off Code Exe Exe Vulnerability “CVE-2024-21410 is an elevation of privilege vulnerability in Microsoft Trade Server,” Satnam Narang, senior group of workers researcher at Tenable, stated in a observation. “This flaw will also be exploited through attackers in step with Microsoft.” “Exploiting this vulnerability may result in the disclosure of the Web-New Era LAN Supervisor (NTLM) model 2 hash, which might be relayed to the inclined Trade Server in an NTLM relay or pass-the-hash, which might permit the attacker to authenticate because the person .”

The protection replace additionally resolves 15 faraway code execution vulnerabilities within the Microsoft WDAC OLE DB supplier for SQL Server that an attacker may exploit through tricking an authenticated person into making an attempt to hook up with a malicious SQL server by means of OLEDB. The patch free up is a repair for CVE-2023-50387 (CVSS rating: 7.5), a 24-year-old flaw within the DNSSEC structure that may be misused to break CPU sources and forestall DNS updates, inflicting a denial-of-service (DoS). The danger has been named KeyTrap through the Nationwide Analysis Middle for Implemented Cybersecurity (ATHENE) in Darmstadt. “[The researchers] confirmed that with a unmarried packet DNS assault can wreck the CPU and forestall the entire maximum used DNS and public DNS suppliers, equivalent to Google Public DNS and Cloudflare,” stated ATHENE. it used to be stopped for 16 hours.” Tool Updates from 3rd-Birthday party Distributors Along with Microsoft, safety updates have additionally been launched through third-party distributors up to now few weeks to mend plenty of problems, together with –

Did you to find this text attention-grabbing? Observe us on Twitter  and LinkedIn to learn extra of our content material.

Author: OpenAI