Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days

Microsoft has resolved a total of 61 new security flaws in its program as portion of its Patch Tuesday updates for May perhaps 2024, which include two zero-times which have been actively exploited in the wild.

Of the 61 flaws, a person is rated Critical, 59 are rated Significant, and one is rated Average in severity. This is in addition to 30 vulnerabilities fixed in the Chromium-primarily based Edge browser over the earlier month, together with two just lately disclosed zero-times (CVE-2024-4671 and CVE-2024-4761) that have been tagged as exploited in attacks.

The two security shortcomings that have been weaponized in the wild are under –

• CVE-2024-30040 (CVSS rating: 8.8) – Windows MSHTML Platform Security Element Bypass Vulnerability
• CVE-2024-30051 (CVSS score: 7.8) – Windows Desktop Window Manager (DWM) Main Library Elevation of Privilege Vulnerability

“An unauthenticated attacker who effectively exploited this vulnerability could obtain code execution through convincing a consumer to open up a malicious doc at which issue the attacker could execute arbitrary code in the context of the person,” the tech giant said in an advisory for CVE-2024-30040.

Having said that, effective exploitation needs an attacker to convince the consumer to load a specially crafted file onto a susceptible program, dispersed possibly by means of email or an immediate message, and trick them into manipulating it. Curiously, the target isn’t going to have to click on or open the destructive file to activate the an infection.

On the other hand, CVE-2024-30051 could permit a menace actor to acquire Method privileges. 3 groups of researchers from Kaspersky, DBAPPSecurity WeBin Lab, Google Threat Evaluation Group, and Mandiant have been credited with getting and reporting the flaw, indicating most likely widespread exploitation.

“We have viewed it employed with each other with QakBot and other malware, and consider that several risk actors have access to it,” Kaspersky researchers Boris Larin and Mert Degirmenci explained.

The two vulnerabilities have been included by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Regarded Exploited Vulnerabilities (KEV) catalog, demanding federal organizations to apply the most current fixes by June 4, 2024.

Also solved by Microsoft are various distant code execution bugs, such as 9 impacting Windows Cellular Broadband Driver and seven influencing Windows Routing and Distant Entry Service (RRAS).

Other notable flaws encompass privilege escalation flaws in the Common Log File Technique (CLFS) driver – CVE-2024-29996, CVE-2024-30025 (CVSS scores: 7.8), and CVE-2024-30037 (CVSS score: 7.5) – Get32k (CVE-2024-30028 and CVE-2024-30030, CVSS scores: 7.8), Windows Lookup Assistance (CVE-2024-30033, CVSS score: 7.), and Windows Kernel (CVE-2024-30018, CVSS score: 7.8).

In March 2024, Kaspersky exposed that danger actors are trying to actively exploit now-patched privilege escalation flaws in different Windows factors owing to the simple fact that “it is really a pretty straightforward way to get a rapid NT AUTHORITYSYSTEM.”

Akamai has further more outlined a new privilege escalation technique influencing Energetic Directory (Advertisement) environments that normally takes edge of the DHCP administrators team.

“In scenarios where by the DHCP server part is installed on a Domain Controller (DC), this could help them to gain domain admin privileges,” the firm noted. “In addition to providing a privilege escalation primitive, the identical system could also be applied to produce a stealthy domain persistence mechanism.

Rounding off the checklist is a security attribute bypass vulnerability (CVE-2024-30050, CVSS rating: 5.4) impacting Windows Mark-of-the-Web (MotW) that could be exploited by indicates of a destructive file to evade defenses.

Program Patches from Other Suppliers

In addition to Microsoft, security updates have also been introduced by other vendors over the previous number of weeks to rectify various vulnerabilities, which include —

• Adobe
• Android
• Apple
• Arm
• ASUS
• Atos
• Broadcom (which include VMware)
• Cacti
• Cisco
• Citrix
• CODESYS
• Dell
• Drupal
• F5
• Fortinet
• GitLab
• Google Chrome
• Google Cloud
• Google Dress in OS
• Hikvision
• Hitachi Vitality
• HP
• HP Company
• HP Company Aruba Networks
• IBM
• Intel
• Jenkins
• Juniper Networks
• Lenovo
• Linux distributions Debian, Oracle Linux, Red Hat, SUSE, and Ubuntu
• MediaTek
• Mitsubishi Electric powered
• MongoDB
• Mozilla Thunderbird
• NVIDIA
• ownCloud
• Palo Alto Networks
• Progress Software package
• QNAP
• Qualcomm
• Rockwell Automation
• Samsung
• SAP
• Schneider Electric
• Siemens
• SolarWinds
• SonicWall
• Tinyproxy
• Veeam
• Veritas
• Zimbra
• Zoom, and
• Zyxel

Discovered this article exciting? Stick to us on Twitter  and LinkedIn to browse a lot more exclusive content we post.

Some parts of this posting are sourced from:
thehackernews.com