Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs

At present is Microsoft’s March 2024 Patch Tuesday, and safety updates have been launched for 60 vulnerabilities, together with eighteen distant code execution flaws.

This Patch Tuesday fixes solely two vital vulnerabilities: Hyper-V distant code execution and denial of service flaws.

The variety of bugs in every vulnerability class is listed beneath

• 24 Elevation of Privilege Vulnerabilities
• 3 Safety Function Bypass Vulnerabilities
• 18 Distant Code Execution Vulnerabilities
• 6 Data Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

The full rely of 60 flaws doesn’t embody 4 Microsoft Edge flaws fastened on March seventh.

Moreover, Microsoft didn’t disclose any zero-days as a part of at the moment’s Patch Tuesday updates.

To be taught extra in regards to the non-security updates launched at the moment, you may evaluation our devoted articles on the brand new Home windows 11 KB5035853 replace and the Home windows 10 KB5035845 replace.

Flaws of curiosity

This month’s Patch Tuesday doesn’t repair any zero-day vulnerabilities however does embody some attention-grabbing flaws, which we’ve got listed beneath.

CVE-2024-21400 – Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

Microsoft fastened a vulnerability in Azure Kubernetes Service that might enable attackers to achieve elevated privileges and steal credentials.

“An attacker who efficiently exploited this vulnerability may steal credentials and have an effect on assets past the safety scope managed by Azure Kubernetes Service Confidential Containers (AKSCC),” explains a Microsoft safety advisory.

The flaw was found by Yuval Avrahami.

CVE-2024-26199 – Microsoft Workplace Elevation of Privilege Vulnerability

Microsoft has fastened a Workplace vulnerability permitting any authenticated consumer to achieve SYSTEM privileges.

“Any authenticated consumer may set off this vulnerability. It doesn’t require admin or different elevated privileges,” explains Microsoft.

The flaw was found by Iván Almuiña from Hacking Company Sàrl.

CVE-2024-20671 – Microsoft Defender Safety Function Bypass Vulnerability

Microsoft has fastened a Microsoft Defender vulnerability that might 

“An authenticated attacker who efficiently exploited this vulnerability may forestall Microsoft Defender from beginning,” explains Microsoft.

Nevertheless, this shall be resolved by Home windows Defender Antimalware Platform updates which are routinely put in on Home windows units.

This flaw is fastened in model 4.18.24010.12 of the Antimalware Platform.

Microsoft says that this flaw was found by Manuel Feifel with Infoguard (Vurex).

CVE-2024-21411 – Skype for Client Distant Code Execution Vulnerability

Microsoft has fastened a distant code execution vulnerability Skype for Client that may be triggered by a malicious hyperlink or picture.

“An attacker may exploit the vulnerability by sending the consumer a malicious hyperlink or a malicious picture by way of Instantaneous Message after which convincing the consumer to click on the hyperlink or picture,” explains Microsoft.

Microsoft says this flaw was found by Hector Peralta  and Nicole Armua working with Pattern Micro Zero Day Initiative.

Latest updates from different firms

Different distributors who launched updates or advisories in March 2024 embody:

The March 2024 Patch Tuesday Safety Updates

Under is the whole record of resolved vulnerabilities within the March 2024 Patch Tuesday updates.

To entry the complete description of every vulnerability and the techniques it impacts, you may view the complete report right here.