Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero-Days Included

Microsoft has produced security updates for the month of April 2024 to remediate a report 149 flaws, two of which have appear below lively exploitation in the wild.

Of the 149 flaws, 3 are rated Critical, 142 are rated Vital, three are rated Reasonable, and a single is rated Reduced in severity. The update is apart from 21 vulnerabilities that the corporation tackled in its Chromium-based Edge browser pursuing the release of the March 2024 Patch Tuesday fixes.

The two shortcomings that have come beneath lively exploitation are below –

• CVE-2024-26234 (CVSS score: 6.7) – Proxy Driver Spoofing Vulnerability
• CVE-2024-29988 (CVSS score: 8.8) – SmartScreen Prompt Security Attribute Bypass Vulnerability

Whilst Microsoft’s have advisory supplies no facts about CVE-2024-26234, cybersecurity company Sophos claimed it learned in December 2023 a malicious executable (“Catalog.exe” or “Catalog Authentication Consumer Company”) that is signed by a valid Microsoft Windows Components Compatibility Publisher (WHCP) certificate.

Authenticode examination of the binary has revealed the original requesting publisher to Hainan YouHu Technology Co. Ltd, which is also the publisher of one more resource known as LaiXi Android Screen Mirroring.

The latter is described as “a marketing and advertising software … [that] can connect hundreds of cellular phones and regulate them in batches, and automate jobs like batch following, liking, and commenting.”

Current within just the purported authentication services is a part known as 3proxy that’s intended to keep track of and intercept network website traffic on an contaminated system, proficiently acting as a backdoor.

“We have no evidence to propose that the LaiXi builders intentionally embedded the malicious file into their item, or that a danger actor carried out a supply chain attack to insert it into the compilation/constructing course of action of the LaiXi software,” Sophos researcher Andreas Klopsch stated.

The cybersecurity company also mentioned it learned multiple other variants of the backdoor in the wild likely all the way back to January 5, 2023, indicating that the marketing campaign has been underway at least since then. Microsoft has since added the applicable files to its revocation list.

The other security flaw that has reportedly come under lively attack is CVE-2024-29988, which – like CVE-2024-21412 and CVE-2023-36025 – makes it possible for attackers to sidestep Microsoft Defender Smartscreen protections when opening a specifically crafted file.

“To exploit this security aspect bypass vulnerability, an attacker would need to persuade a user to launch destructive files working with a launcher application that requests that no UI be demonstrated,” Microsoft said.

“In an email or prompt information attack state of affairs, the attacker could send out the specific user a specially crafted file that is made to exploit the remote code execution vulnerability.”

The Zero Working day Initiative unveiled that there is evidence of the flaw currently being exploited in the wild, despite the fact that Microsoft has tagged it with an “Exploitation Much more Very likely” evaluation.

Yet another vulnerability of worth is CVE-2024-29990 (CVSS score: 9.), an elevation of privilege flaw impacting Microsoft Azure Kubernetes Support Private Container that could be exploited by unauthenticated attackers to steal credentials.

“An attacker can obtain the untrusted AKS Kubernetes node and AKS Private Container to consider more than confidential guests and containers outside of the network stack it may be certain to,” Redmond mentioned.

In all, the launch is notable for addressing as several as 68 remote code execution, 31 privilege escalation, 26 security feature bypass, and six denial-of-support (DoS) bugs. Apparently, 24 of the 26 security bypass flaws are connected to Protected Boot.

“Whilst none of these Secure Boot vulnerabilities addressed this month had been exploited in the wild, they provide as a reminder that flaws in Protected Boot persist, and we could see much more destructive exercise linked to Protected Boot in the potential,” Satnam Narang, senior employees investigation engineer at Tenable, said in a assertion.

The disclosure comes as Microsoft has faced criticism for its security procedures, with a the latest report from the U.S. Cyber Safety Assessment Board (CSRB) calling out the firm for not undertaking enough to avert a cyber espionage campaign orchestrated by a Chinese risk actor tracked as Storm-0558 final yr.

It also follows the firm’s decision to publish root trigger details for security flaws making use of the Frequent Weakness Enumeration (CWE) marketplace regular. On the other hand, it is really truly worth noting that the adjustments are only in influence beginning from advisories posted because March 2024.

“The addition of CWE assessments to Microsoft security advisories aids pinpoint the generic root lead to of a vulnerability,” Adam Barnett, lead software engineer at Rapid7, said in a assertion shared with The Hacker Information.

“The CWE system has not long ago updated its guidance on mapping CVEs to a CWE Root Trigger. Assessment of CWE traits can support builders cut down long run occurrences by means of improved Computer software Enhancement Life Cycle (SDLC) workflows and screening, as nicely as helping defenders recognize wherever to direct defense-in-depth and deployment-hardening efforts for ideal return on expense.”

In a similar improvement, cybersecurity firm Varonis thorough two methods that attackers could undertake to circumvent audit logs and stay clear of triggering down load activities while exfiltrating information from SharePoint.

The very first solution usually takes gain of SharePoint’s “Open in Application” feature to entry and obtain information, whereas the 2nd utilizes the Person-Agent for Microsoft SkyDriveSync to download data files or even complete web sites although miscategorizing these types of gatherings as file syncs as a substitute of downloads.

Microsoft, which was made aware of the issues in November 2023, has nevertheless to launch a resolve, although they have been additional to their patch backlog program. In the interim, organizations are advised to carefully watch their audit logs for suspicious access functions, specially those that include massive volumes of file downloads within a shorter interval.

“These strategies can bypass the detection and enforcement policies of common applications, this sort of as cloud entry security brokers, data decline avoidance, and SIEMs, by hiding downloads as less suspicious entry and sync gatherings,” Eric Saraga stated.

Software program Patches from Other Vendors

In addition to Microsoft, security updates have also been unveiled by other suppliers more than the earlier couple months to rectify quite a few vulnerabilities, like —

• Adobe
• AMD
• Android
• Aruba Networks
• Atos
• Bosch
• Cisco
• D-Hyperlink
• Dell
• Drupal
• F5
• Fortinet
• Fortra
• GitLab
• Google Chrome
• Google Cloud
• Google Pixel
• Hikvision
• Hitachi Power
• HP
• HP Business
• HTTP/2
• IBM
• Jenkins
• Lenovo
• LG webOS
• Linux distributions Debian, Oracle Linux, Crimson Hat, SUSE, and Ubuntu
• MediaTek
• Mozilla Firefox, Firefox ESR, and Thunderbird
• NETGEAR
• NVIDIA
• Qualcomm
• Rockwell Automation
• Rust
• Samsung
• SAP
• Schneider Electric powered
• Siemens
• Splunk
• Synology
• Pattern Micro
• VMware
• WordPress, and
• Zoom

Observed this post interesting? Abide by us on Twitter  and LinkedIn to read more exclusive content we write-up.

Some parts of this write-up are sourced from:
thehackernews.com