Microsoft’s January 2024 Windows Update Patches 48 New Vulnerabilities

Microsoft has dealt with a complete of 48 security flaws spanning its computer software as section of its Patch Tuesday updates for January 2024.

Of the 48 bugs, two are rated Critical and 46 are rated Essential in severity. There is no proof that any of the issues are publicly regarded or less than lively attack at the time of release, creating it the 2nd consecutive Patch Tuesday with no zero-times.

The fixes are in addition to 9 security vulnerabilities that have been resolved in the Chromium-based mostly Edge browser considering the fact that the launch of December 2023 Patch Tuesday updates. This also contains a fix for a zero-day (CVE-2023-7024, CVSS rating: 8.8) that Google mentioned has been actively exploited in the wild.

The most critical among flaws patched this month are as follows –

• CVE-2024-20674 (CVSS score: 9.) – Windows Kerberos Security Feature Bypass Vulnerability
• CVE-2024-20700 (CVSS score: 7.5) – Windows Hyper-V Distant Code Execution Vulnerability

“The authentication element could be bypassed as this vulnerability lets impersonation,” Microsoft said in an advisory for CVE-2024-20674.

“An authenticated attacker could exploit this vulnerability by setting up a equipment-in-the-middle (MitM) attack or other neighborhood network spoofing strategy, then sending a destructive Kerberos concept to the shopper sufferer device to spoof by itself as the Kerberos authentication server.”

Even so, the enterprise famous that profitable exploitation requires an attacker to obtain accessibility to the restricted network initially. Security researcher ldwilmore34 has been credited with finding and reporting the flaw.

CVE-2024-20700, on the other hand, neither requires authentication nor user conversation to obtain remote code execution, despite the fact that profitable a race issue is a prerequisite to staging an attack.

“It isn’t really apparent particularly exactly where the attacker need to be located — the LAN on which the hypervisor resides, or a digital network designed and managed by the hypervisor — or in what context the distant code execution would manifest,” Adam Barnett, lead software engineer at Fast7, explained to The Hacker News.

Other noteworthy flaws contain CVE-2024-20653 (CVSS rating: 7.8), a privilege escalation flaw impacting the Common Log File Method (CLFS) driver, and CVE-2024-0056 (CVSS rating: 8.7), a security bypass affecting Procedure.Info.SqlClient and Microsoft.Details.SqlClient.

“An attacker who productively exploited this vulnerability could have out a device-in-the-center (MitM) attack and could decrypt and browse or modify TLS site visitors amongst the shopper and server,” Redmond claimed.

Microsoft even further pointed out that it really is disabling the skill to insert FBX documents in Term, Excel, PowerPoint, and Outlook in Windows by default thanks to a security flaw (CVE-2024-20677, CVSS score: 7.8) that could guide to remote code execution.

“3D versions in Business office paperwork that were previously inserted from an FBX file will continue on to perform as envisioned unless the ‘Link to File’ possibility was selected at the insert time,” Microsoft claimed in a separate alert. “GLB (Binary GL Transmission Structure) is the advised substitute 3D file format for use in Business.”

It really is worthy of noting that Microsoft took a very similar stage of disabling the SketchUp (SKP) file format in Business adhering to ZScaler’s discovery of 117 security flaws in Microsoft 365 programs.

Software Patches from Other Distributors

In addition to Microsoft, security updates have also been unveiled by other sellers around the previous couple months to rectify various vulnerabilities, together with –

• Adobe
• AMD
• Android
• Arm
• ASUS
• Bosch
• Cisco
• Dell
• F5
• Fortinet
• Google Chrome
• Google Cloud
• HP
• IBM
• Intel
• Lenovo
• Linux distributions Debian, Oracle Linux, Pink Hat, SUSE, and Ubuntu
• MediaTek
• NETGEAR
• Qualcomm
• Samsung
• SAP
• Schneider Electrical
• Siemens
• Splunk
• Synology
• Development Micro
• Zimbra, and
• Zoom

Identified this report exciting? Abide by us on Twitter  and LinkedIn to examine much more distinctive information we put up.

Some parts of this article are sourced from:
thehackernews.com