Microsoft’s March Updates Fix 61 Vulnerabilities, Including Critical Hyper-V Flaws

Microsoft on Tuesday released its month to month security update, addressing 61 different security flaws spanning its program, like two critical issues impacting Windows Hyper-V that could lead to denial-of-services (DoS) and distant code execution.

Of the 61 vulnerabilities, two are rated Critical, 58 are rated Critical, and one particular is rated Small in severity. None of the flaws are shown as publicly recognized or below energetic attack at the time of the launch, but 6 of them have been tagged with an “Exploitation A lot more Probable” evaluation.

The fixes are in addition to 17 security flaws that have been patched in the company’s Chromium-primarily based Edge browser since the launch of the February 2024 Patch Tuesday updates.

Topping the record of critical shortcomings are CVE-2024-21407 and CVE-2024-21408, which impact Hyper-V and could consequence in remote code execution and a DoS situation, respectively.

Microsoft’s update also addresses privilege escalation flaws in the Azure Kubernetes Assistance Confidential Container (CVE-2024-21400, CVSS score: 9.), Windows Composite Image File Program (CVE-2024-26170, CVSS rating: 7.8), and Authenticator (CVE-2024-21390, CVSS rating: 7.1).

Thriving exploitation of CVE-2024-21390 demands the attacker to have a regional presence on the unit possibly by using malware or a destructive software previously installed by way of some other usually means. It also necessitates that the victim closes and re-opens the Authenticator app.

“Exploitation of this vulnerability could let an attacker to obtain entry to multi-variable authentication codes for the victim’s accounts, as very well as modify or delete accounts in the authenticator application but not avert the app from launching or operating,” Microsoft reported in an advisory.

“While exploitation of this flaw is thought of less possible, we know that attackers are eager to come across techniques to bypass multi-variable authentication,” Satnam Narang, senior workers study engineer at Tenable, reported in a statement shared with The Hacker Information.

“Having accessibility to a concentrate on system is lousy adequate as they can keep an eye on keystrokes, steal details and redirect buyers to phishing sites, but if the objective is to continue to be stealth, they could maintain this access and steal multi-issue authentication codes in purchase to login to sensitive accounts, steal data or hijack the accounts completely by transforming passwords and changing the multi-element authentication unit, proficiently locking the user out of their accounts.”

An additional vulnerability of observe is a privilege escalation bug in the Print Spooler element (CVE-2024-21433, CVSS rating: 7.) that could allow an attacker to attain System privileges but only upon successful a race condition.

The update also plugs a remote code execution flaw in Exchange Server (CVE-2024-26198, CVSS score: 8.8) that an unauthenticated threat actor could abuse by positioning a specifically crafted file on to an on line listing and tricking a victim into opening it, resulting in the execution of destructive DLL files.

The vulnerability with the greatest CVSS ranking is CVE-2024-21334 (CVSS score: 9.8), which considerations a case of distant code execution affecting the Open up Administration Infrastructure (OMI).

“A remote unauthenticated attacker could entry the OMI instance from the Internet and send out specially crafted requests to bring about a use-just after-totally free vulnerability,” Redmond stated.

“The initial quarter of Patch Tuesday in 2024 has been quieter in comparison to the very last 4 a long time,” Narang stated. “On average, there have been 237 CVEs patched in the initial quarter from 2020 as a result of 2023. In the first quarter of 2024, Microsoft only patched 181 CVEs. The ordinary selection of CVEs patched in March more than the very last 4 decades was 86.”

Software program Patches from Other Distributors

In addition to Microsoft, security updates have also been launched by other sellers about the past several months to rectify several vulnerabilities, which includes —

• Adobe
• AMD
• Android
• Apple
• Aruba Networks
• Arm
• Bosch
• Canon
• Cisco
• Citrix
• CODESYS
• Dell
• Drupal
• F5
• Fortinet
• GitLab
• Google Chrome
• Google Cloud
• Google Use OS
• Hikvision
• Hitachi Power
• HP
• IBM
• Intel
• Jenkins
• JetBrains TeamCity
• Lenovo
• Linux distributions Debian, Oracle Linux, Crimson Hat, SUSE, and Ubuntu
• MediaTek
• Mitsubishi Electrical
• MongoDB
• Mozilla Firefox, Firefox ESR, and Thunderbird
• NETGEAR
• NVIDIA
• Development Computer software OpenEdge
• QNAP
• Qualcomm
• Samsung
• SAP
• Schneider Electrical
• Siemens
• SolarWinds
• SonicWall
• Spring Framework
• Synology
• VMware
• Zoom, and
• Zyxel

Discovered this post attention-grabbing? Observe us on Twitter  and LinkedIn to read extra exceptional content material we article.

Some parts of this article are sourced from:
thehackernews.com