Microsoft Patch Tuesday – October 2024

Microsoft patched 117 CVEs in October 2024 Patch Tuesday release, with three rated critical, 113 rated important and one rated moderate.

• 27 Elevation of Privilege vulnerabilities
• 7 Security Feature Bypass vulnerabilities
• 43 Remote Code Execution vulnerabilities
• 6 Information Disclosure vulnerabilities
• 26 Denial of Service vulnerabilities
• 7 Spoofing vulnerabilities

Based on the active exploitation evidence, CISA has added CVE-2024-43572 , CVE-2024-43573 to its Known exploited catalog

Microsoft Configuration Manager Remote Code Execution Vulnerability

The vulnerability tracked as CVE-2024-43468 is a RCE with a CVSSv3 score of 9.8in Microsoft Configuration. An attacker can leverage this vulnerability without prior authentication by sending a specially crafted request to a vulnerable machine resulting in RCE on the machine or its underlying database.

Microsoft has advised impacted users to install an in-console update as the only mitigation path, but has listed a workaround for users who cannot immediately implement the updates. The workaround suggested by Microsoft is to use an alternate service account for the Management point connection account in place of the default “Computer” account.

Windows Netlogon Elevation of Privilege Vulnerability

The vulnerability tracked as CVE-2024-38124 with a CVSSv3 score of 9.0. An attacker would need authenticated access to the same network as a vulnerable device and rename their machine to match the domain controller to establish a secure channel. If these prerequisites are met, the attacker would then need to rename their machine back to its original name and once the new domain controller is promoted, the attacker could use the secure channel to impersonate the domain controller and potentially compromise the entire domain.

No workarounds available, but if immediate patching is not an option, Microsoft has listed a handful of mitigating factors to consider:

• Avoid using predictable naming conventions on Domain Controllers
• Ensure Secure Channel validation requires more than just a matching computer name.
• Monitoring for the renaming of computers within the network.
• Consider enhanced authentication mechanisms.

Microsoft Management Console Remote Code Execution Vulnerability

The vulnerability tracked as CVE-2024-43572 with a CVSSv3 score of 7.8. An attacker could exploit this vulnerability by convincing a vulnerable target using social engineering tactics to open a specially crafted file. Successful exploitation would allow the attacker to execute arbitrary code.

This CVE-2024-43572 was exploited in the wild as a zero-day. This is the second month in a row that Microsoft patched a RCE vulnerability in the MMC, as Microsoft addressed CVE-2024-38259 in its September 2024 Patch Tuesday release. As part of its patch for CVE-2024-43572, Microsoft has altered the behavior for Microsoft Saved Console (MSC) files, preventing untrusted MSC files from being opened on a system.

Windows MSHTML Platform Spoofing Vulnerability

The vulnerability tracked as CVE-2024-43573 with a CVSSv3 score of 6.5, an unauthenticated, remote attacker could exploit this vulnerability by convincing a potential target to open a malicious file.

This vulnerability CVE-2024-43573 was exploited in the wild as a zero-day. This is the fourth zero-day vulnerability in the Windows MSHTML Platform that was exploited in the wild in 2024, which include CVE-2024-30040, a security feature bypass flaw that was patched in May 2024, CVE-2024-38112, a spoofing vulnerability that was patched in July 2024 and CVE-2024-43461, a spoofing vulnerability that was patched on September 10, 2024, though details about in-the-wild exploitation was not known until September 13, 2024. Both CVE-2024-38112 and CVE-2024-43461 were used as part of an exploit chain by an advanced persistent threat (APT) actor known as Void Banshee.

Windows Hyper-V Security Feature Bypass Vulnerability

The vulnerability tracked as CVE-2024-20659 with a CVSSv3 score of 7.1 is a security feature bypass vulnerability in Windows Hyper-V. This is likely because there are multiple conditions that need to be met for exploitation to be feasible, such as a user rebooting their machine and application specific behavior among other user-required actions. Successful exploitation would allow an attacker to bypass a Virtual Machine’s UEFI on the host machine, resulting in both the hypervisor and secure kernel being compromised. According to Microsoft, CVE-2024-20659 was publicly disclosed prior to a patch being made available.

In addition to CVE-2024-20659, Microsoft also addressed three denial of service (DoS) CVE-2024-43521, CVE-2024-43567, CVE-2024-43575 vulnerabilities and one RCE CVE-2024-3009 in Windows Hyper-V.

Winlogon Elevation of Privilege Vulnerability

The vulnerability tracked as CVE-2024-43583 with a CVSSv3 score of 7.8, a local authenticated attacker could exploit this vulnerability to gain SYSTEM privileges. According to Microsoft, CVE-2024-43583 was publicly disclosed prior to a patch being made available. In addition to applying the available patch for CVE-2024-43583, Microsoft recommends enabling Microsoft first-party Input Method Editor (IME) to thwart vulnerabilities within third-party IMEs.

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

The 12 vulnerabilities tracked as CVE-2024-38212, CVE-2024-38261, CVE-2024-38265, CVE-2024-43453, CVE-2024-43549, CVE-2024-43564, CVE-2024-43589, CVE-2024-43592, CVE-2024-43593, CVE-2024-43607, CVE-2024-43608 and CVE-2024-43611 are a series of RCE vulnerabilities in Windows Routing and Remote Access Service (RRAS) accounting for 10% of the vulnerabilities in the October Microsoft Patch Tuesday update. All 12 of these vulnerabilities share a common CVSSv3 score of 8.8 apart from CVE-2024-38261 which was assigned a score of 7.8.

They share similar attack paths based on Microsoft’s descriptions of the vulnerabilities. An attacker with no authentication could leverage this vulnerability by targeting a vulnerable server with a specially crafted protocol message or tricking a user to submit a request to a malicious server resulting in a malicious message being returned, which could lead to RCE on the vulnerable machine.

Remote Desktop Client Remote Code Execution Vulnerability

The 2 vulnerabilities tracked as CVE-2024-43533 and CVE-2024-43599 are a pair of RCE vulnerabilities with a CVSSv3 score of 8.8. The attack vector noted by Microsoft lists a prerequisite of an attacker first compromising a Remote Desktop Server. Once compromised, the attacker can leverage RCE against vulnerable connecting devices. As a mitigating factor and part of security best practices, it is suggested that the Remote Desktop service should be disabled if not needed. Microsoft’s advisory further explains that disabling unused services can help reduce exposure.

Patch Tuesday Summary