Microsoft Patch Tuesday – February -2024 Valentine Day Special

Microsoft has released patches for 73 CVEs in its February Patch Tuesday release, with five rated critical, 66 rated as important and two rated as moderate.

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2024-21351 is a security feature bypass vulnerability in Windows SmartScreen. It was assigned a CVSSv3 score of 7.6 and is rated moderate. An attacker could exploit this vulnerability by convincing a target to open a malicious file. Successful exploitation would bypass SmartScreen security features. According to Microsoft, this vulnerability has been exploited in the wild as a zero-day, though no specific details about exploitation were available at the time this blog was published.

Internet Shortcut Files Security Feature Bypass Vulnerability

CVE-2024-21412 is a security feature bypass in Internet Shortcut Files. It was assigned a CVSSv3 score of 8.1 and is rated important. Exploitation of this flaw requires an attacker to convince their intended target to open a malicious Internet Shortcut File using social engineering. This vulnerability was exploited in the wild as a zero-day. No specific details about this zero-day vulnerability were available at the time of the February Patch Tuesday release.

Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2024-21410 is a critical EoP vulnerability with a CVSSv3 score of 9.8 and is rated Exploitation More Likely. Successful exploitation of this flaw would allow an attacker to relay a New Technology LAN Manager Version 2 (NTLMv2) hash against a vulnerable server. NTLM hashes could be abused in NTLM relay or pass-the-hash attacks to further an attacker’s foothold into an organization.

According to Microsoft, Exchange Server 2019 Cumulative Update 14 and prior did not enable NTLM credentials Relay Protections by default. Microsoft’s advisory provides a link to a script to enable the protection and recommends installing the latest cumulative update, even if the script to enable the NTLM credentials Relay Protections has been run.

Microsoft Outlook Remote Code Execution Vulnerability

CVE-2024-21378 is a RCE vulnerability affecting Microsoft Outlook. This flaw is rated as “Exploitation More Likely” and was assigned a CVSSv3 score of 8.0. To exploit this flaw, an attacker would need to be authenticated with LAN-access and have a valid login for an Exchange user. If the attacker meets those requirements, they will then have to send their maliciously crafted file to a user and entice them to open it. According to Microsoft, the preview pane is an attack vector, meaning that simply previewing a specially crafted file can cause the exploit to trigger.

Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-21338, CVE-2024-21345 and CVE-2024-21371 are EoP vulnerabilities affecting the Windows Kernel. The vulnerabilities were each given different CVSSv3 scores varying from 8.8 for CVE-2024-21345 to 7.0 for CVE-2024-21371 with each rated as “Exploitation More Likely.” An attacker could exploit these vulnerabilities as part of post-compromise activity to elevate privileges to SYSTEM.

In addition to these EoP vulnerabilities, three additional Windows Kernel vulnerabilities were patched this month: CVE-2024-21340, CVE-2024-21341, CVE-2024-21362

Microsoft patch Tuesday Summary