⚡Microsoft's November 2024 Patch Tuesday: A Comprehensive Overview⚡

Introduction

Microsoft's November 2024 Patch Tuesday has brought a significant number of updates aimed at enhancing the security and stability of various Microsoft products. This month's release addresses a total of 91 vulnerabilities, including four zero-day exploits. Below is a detailed breakdown of these vulnerabilities by type:

• Remote Code Execution (RCE) Vulnerabilities: 52
• Elevation of Privilege (EoP) Vulnerabilities: 26
• Denial of Service (DoS) Vulnerabilities: 4
• Spoofing Vulnerabilities: 3
• Security Feature Bypass (SFB) Vulnerabilities: 2
• Information Disclosure Vulnerability: 1

Key Highlights

01. Zero-Day Vulnerabilities

• CVE-2024-49039: A critical flaw in the Windows Task Scheduler that allows attackers to elevate their privileges. This vulnerability has been actively exploited in the wild.
• CVE-2024-43451: A spoofing vulnerability that exposes NTLMv2 hashes, enabling attackers to perform "pass-the-hash" attacks.
• CVE-2024-49040: A spoofing vulnerability in Microsoft Exchange Server, which could allow attackers to deceive recipients by spoofing email addresses.
• CVE-2024-49019: An elevation of privilege flaw in Active Directory Certificate Services, potentially allowing attackers to gain domain administrator privileges.

02. Critical Vulnerabilities

• CVE-2024-43639: A remote code execution vulnerability in Windows Kerberos, which could allow attackers to execute code remotely by exploiting weaknesses in the cryptographic protocol.
• CVE-2024-43498: A remote code execution flaw in .NET and Visual Studio, with a CVSS severity rating of 9.8.

03. Other Notable Fixes

• Memory-Related Security Issues: At least 29 updates address memory-related vulnerabilities in SQL Server, each with a threat score of 8.8.
• Remote Code Execution (RCE) Vulnerabilities: 52 RCE vulnerabilities were patched, which could allow attackers to execute arbitrary code on vulnerable systems.
• Elevation of Privilege (EoP) Vulnerabilities: 26 EoP vulnerabilities were addressed, enabling attackers to gain higher-level access than authorized.

Detailed Breakdown

• Remote Code Execution (RCE) Vulnerabilities: These vulnerabilities are particularly dangerous as they allow attackers to execute arbitrary code on a target system remotely. This month's updates include fixes for 52 RCE vulnerabilities across various Microsoft products.
• Elevation of Privilege (EoP) Vulnerabilities: EoP vulnerabilities enable attackers to gain unauthorized access to higher-level privileges. This month's patch addresses 26 such vulnerabilities.
• Denial of Service (DoS) Vulnerabilities: Four DoS vulnerabilities were fixed, which could disrupt services by overloading systems.
• Spoofing Vulnerabilities: Three spoofing vulnerabilities were addressed, which could allow attackers to deceive users by impersonating legitimate entities.
• Security Feature Bypass (SFB) Vulnerabilities: Two SFB vulnerabilities were patched, which could allow attackers to bypass security features designed to protect systems.
• Information Disclosure Vulnerability: One information disclosure vulnerability was fixed, which could potentially expose sensitive information to unauthorized users.

Conclusion

The November 2024 Patch Tuesday underscores the critical importance of timely updates to protect against potential cyber threats. With 91 vulnerabilities addressed, including four zero-day exploits, it is essential for users and administrators to apply these patches promptly to safeguard their systems.

Stay vigilant and ensure your systems are up-to-date to mitigate the risks posed by these vulnerabilities.

The complete list of the vulnerabilities can be found here - Microsoft release notes.

Keep Exploring. Happy Learning! 😊

Read More

✨ Microsoft Entra ID Reintroduces WhatsApp for MFA OTP Delivery ✨

 

In late 2023, Microsoft Entra began leveraging WhatsApp as an alternate channel to deliver multifactor authentication (MFA) one-time passcodes (OTPs) to users in India and Indonesia. This initiative saw improved deliverability, completion rates, and user satisfaction in both countries. Although the channel was temporarily disabled in India in early 2024, Microsoft is set to re-enable it in December 2024 and expand its use to additional countries.

When Will This Happen?

Starting in December 2024, users in India and other countries may begin receiving MFA text messages via WhatsApp. This feature will be available to users who are enabled to receive MFA text messages as an authentication method and already have WhatsApp installed on their phones. If a user with WhatsApp is unreachable or lacks internet connectivity, the system will quickly fall back to the regular SMS channel. Additionally, users receiving OTPs via WhatsApp for the first time will be notified of the change in behavior via SMS text message.

How Will This Affect Your Organization?

If you are a Microsoft Entra workforce customer currently using text-message authentication, it is recommended to notify your helpdesk about this upcoming change. The sender agent in WhatsApp will be branded as Microsoft with a verified checkmark, ensuring users recognize the legitimacy of the messages.

Organizations that prefer not to use WhatsApp for MFA text messages can disable this authentication method. However, Microsoft highly encourages moving to more modern, secure methods like Microsoft Authenticator and passkeys.

Key Highlights

• WhatsApp Delivery: Users with WhatsApp will receive MFA OTPs directly in the app, with SMS as a fallback if needed.
• Verified Sender: Messages will come from Microsoft with a verified checkmark.
• Enhanced User Experience: Improved deliverability and user satisfaction based on prior implementations in India and Indonesia.

Recommendations

• Inform Your Helpdesk: If you currently use text-message authentication, inform your helpdesk about this change.
• Consider More Secure Methods: Microsoft recommends adopting more secure authentication mechanisms, such as Microsoft Authenticator and passkeys.

What You Need to Do to Prepare

This rollout will happen automatically with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.

Keep Exploring. Happy Learning! 😊

Read More

⚡Microsoft's October 2024 Patch Tuesday: A Comprehensive Overview⚡

 

Introduction

Microsoft's October 2024 Patch Tuesday has addressed a total of 118 security vulnerabilities, including five zero-day vulnerabilities and three critical vulnerabilities. This month's updates span across various Microsoft products and services, enhancing security and stability for users worldwide. Below is a detailed breakdown of these vulnerabilities by type:

• Remote Code Execution (RCE) Vulnerabilities: 43
• Elevation of Privilege (EoP) Vulnerabilities: 28
• Denial of Service (DoS) Vulnerabilities: 26
• Spoofing Vulnerabilities: 7
• Security Feature Bypass (SFB) Vulnerabilities: 7
• Information Disclosure Vulnerabilities: 6

Key Highlights

01. Zero-Day Vulnerabilities

• CVE-2024-43572: A critical remote code execution (RCE) vulnerability in the Microsoft Management Console (MMC). This flaw can be exploited by convincing a user to open a specially crafted malicious MSC file.
• CVE-2024-43573: An actively exploited spoofing vulnerability in the Windows MSHTML platform, part of the Trident engine used by Internet Explorer and older versions of Microsoft Edge.
• CVE-2024-20659: A UEFI security feature bypass vulnerability in Windows Hyper-V.
• CVE-2024-43583: An elevation of privilege vulnerability in Windows Winlogon, requiring a first-party Microsoft IME to be fixed.
• CVE-2024-6197: A remote code execution vulnerability in libcurl, fixed in Windows’ bundled version of the tool.

02. Critical Vulnerabilities

• All three critical vulnerabilities are remote code execution flaws. These could allow attackers to run arbitrary code on affected systems, posing significant security risks.

03. Important Vulnerabilities

• The majority of the vulnerabilities addressed are classified as important. These include elevation of privilege flaws, denial of service issues, spoofing vulnerabilities, and security feature bypass bugs.

Detailed Patch Information

• Windows 11, Version 24H2 (KB5044284): This update addresses several security issues and includes improvements from the previous update (KB5043178). Notable fixes include resolving issues with the Remote Desktop Gateway Service and improvements to the Windows servicing stack.
• Microsoft Office, Microsoft Edge, Visual Studio, Azure CLI, Microsoft Defender for Endpoint: Various components received updates to address security vulnerabilities, ensuring a more secure environment for users.

Known Issues

• DirectAccess Connection Issues: After a fresh install or an in-place upgrade to Windows 11, version 24H2, users might face issues with DirectAccess connections.
• Roblox on ARM Devices: Players on ARM devices may experience difficulties downloading and playing Roblox via the Microsoft Store. A workaround is to download the game directly from the Roblox website.

Conclusion

The October 2024 Patch Tuesday updates are crucial for maintaining the security and stability of Microsoft products. Users are strongly encouraged to install these updates promptly to protect their systems from potential exploits and vulnerabilities. For detailed information on each vulnerability and the corresponding updates, users can refer to the official Microsoft Security Update Guide - Microsoft release notes.

Keep Exploring. Happy Learning! 😊

Read More

⚡Microsoft's September 2024 Patch Tuesday: A Comprehensive Overview⚡

Introduction

Microsoft's September 2024 Patch Tuesday has addressed a total of 79 security vulnerabilities, including four zero-day vulnerabilities and seven critical vulnerabilities. This month's updates span across various Microsoft products and services, enhancing security and stability for users worldwide. Below is a detailed breakdown of these vulnerabilities by type:

• Remote Code Execution (RCE): 12
• Elevation of Privilege (EoP): 35
• Denial of Service (DoS): 4
• Spoofing Vulnerabilities: 3
• Security Feature Bypass (SFB): 3
• Information Disclosure: 18
• Cross-Site Scripting (XSS): 1
• Other vulnerabilities: 3

Key Highlights

01. Zero-Day Vulnerabilities

• Mark-of-the-Web Bypass (CVE-2024-38217): Actively exploited, allowing crafted files to bypass SmartScreen or attachment services. This vulnerability highlights risks associated with file downloads.
• Windows Installer EoP (CVE-2024-38014): Exploited locally to grant SYSTEM privileges due to improper privilege management.
• Microsoft Publisher Macro Policy Bypass (CVE-2024-38226): Requires local user authentication to bypass macro restrictions, posing risks for organizations.
• SharePoint Critical RCEs (e.g., CVE-2024-38018): Exploits deserialization flaws to gain control via malicious uploads, emphasizing the need for secure configurations.

02. Critical RCE Vulnerabilities

• Affect key products like SharePoint and Windows Network Address Translation (NAT). The NAT vulnerability (CVE-2024-38119) involves a "use-after-free" flaw, requiring network adjacency for exploitation.

03. Product-Specific Updates

• Windows: Multiple privilege elevation and RCE patches for Windows 10, 11, and Server editions.
• Microsoft 365 Apps: Fixes for Excel, Publisher, and SharePoint vulnerabilities.
• Power Automate: An RCE vulnerability (CVE-2024-43479) addressed for secure automation workflows.

04. Zero-Day Defense Recommendations

• Regularly update software to prevent exploitation.
• Enable enhanced security features like SmartScreen and macro-blocking policies.
• Monitor for suspicious activity on systems running affected versions.

Conclusion

With 35 elevation-of-privilege vulnerabilities addressed and critical fixes for RCE vulnerabilities in widely-used tools like SharePoint, the September 2024 Patch Tuesday underlines Microsoft's commitment to securing its ecosystem. Organizations should prioritize deploying these patches to ensure compliance and maintain a robust security posture.

The complete list of the vulnerabilities can be found here - Microsoft release notes.

Keep Exploring. Happy Learning! 😊

Read More