Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws

Lately is Microsoft’s November 2024 Patch Tuesday, which incorporates safety updates for 89 flaws, together with 4 zero-days, two of which can be actively exploited.

This Patch Tuesday fastened 4 vital vulnerabilities, which come with two far off code execution and two elevation of privileges flaws.

The choice of insects in every vulnerability class is indexed under:

• 26 Elevation of Privilege vulnerabilities
• 2 Safety Function Bypass vulnerabilities
• 52 Far off Code Execution vulnerabilities
• 1 Knowledge Disclosure vulnerability
• 4 Denial of Carrier vulnerabilities
• 3 Spoofing vulnerabilities

This rely does now not come with two Edge flaws that have been prior to now fastened on November seventh.

To be informed extra in regards to the non-security updates launched lately, you’ll overview our devoted articles at the new Home windows 11 KB5046617 and KB5046633 cumulative updates and the Home windows 10 KB5046613 replace.

4 zero-days disclosed

This month’s Patch Tuesday fixes 4 zero-days, two of which have been actively exploited in assaults, and 3 have been publicly disclosed.

Microsoft classifies a zero-day flaw as one this is publicly disclosed or actively exploited whilst no legit repair is to be had.

The 2 actively exploited zero-day vulnerabilities in lately’s updates are:

CVE-2024-43451 – NTLM Hash Disclosure Spoofing Vulnerability

Microsoft has fastened a vulnerability that exposes NTLM hashes to far off attackers with minimum interplay with a malicious document.

“This vulnerability discloses a person’s NTLMv2 hash to the attacker who may just use this to authenticate because the person,” defined Microsoft.

“Minimum interplay with a malicious document by way of a person comparable to settling on (single-click), examining (right-click), or appearing an motion rather than opening or executing may just cause this vulnerability,” endured Microsoft.

Microsoft says Israel Yeshurun of ClearSky Cyber Safety came upon this vulnerability and that it was once publicly disclosed, however didn’t percentage any longer main points.

CVE-2024-49039 – Home windows Job Scheduler Elevation of Privilege Vulnerability

A specifically crafted software might be completed that elevates privilege to Medium Integrity stage.

“On this case, a a hit assault might be carried out from a low privilege AppContainer. The attacker may just carry their privileges and execute code or get right of entry to assets at the next integrity stage than that of the AppContainer execution surroundings,” defined Microsoft.

Microsoft says that exploiting this vulnerability would permit attackers to execute RPC purposes which can be most often limited to privileged accounts.

The flaw was once came upon by way of Vlad Stolyarov and Bahare Sabouri of Google’s Danger Research Team.

It’s not recognized how the flaw was once exploited in assaults.

The opposite 3 vulnerabilities that have been publicly disclosed however now not exploited in assaults are:

CVE-2024-49040 – Microsoft Trade Server Spoofing Vulnerability

Microsoft has fastened a Microsoft Trade vulnerability that permits risk actors to spoof the sender’s e-mail deal with in emails to native recipients.

“Microsoft is conscious about a vulnerability (CVE-2024-49040) that permits attackers to run spoofing assaults in opposition to Microsoft Trade Server,” explains a comparable advisory by way of Microsoft.

“The vulnerability is brought about by way of the present implementation of the P2 FROM header verification, which occurs in shipping.”

Beginning with this month’s Microsoft Trade safety updates, Microsoft is now detecting and flagging spoofed emails with an alert prepended to the e-mail frame that states, “Understand: This e-mail seems to be suspicious. Don’t accept as true with the tips, hyperlinks, or attachments on this e-mail with out verifying the supply thru a depended on way.”

Microsoft says the flaw was once came upon by way of Slonser at Solidlab, who publicly disclosed the flaw on this article.

CVE-2024-49019 – Lively Listing Certificates Products and services Elevation of Privilege Vulnerability

Microsoft fastened a flaw that permits attackers to realize area administrator privileges by way of abusing integrated default model 1 certificates templates.

“Test in case you have printed any certificate created the use of a model 1 certificates template the place the Supply of matter title is ready to “Equipped within the request” and the Join permissions are granted to a broader set of accounts, comparable to area customers or area computer systems,” explains Microsoft.

“An instance is the integrated Internet Server template, however it’s not inclined by way of default because of its limited Join permissions.”

The flaw was once came upon by way of Lou Scicchitano, Scot Berner, and Justin Bollinger with TrustedSec, who disclosed the “EKUwu” vulnerability in October.

“The use of integrated default model 1 certificates templates, an attacker can craft a CSR to incorporate software insurance policies which can be most popular over the configured Prolonged Key Utilization attributes specified within the template,” reads TrustedSec’s file.

“The one requirement is enrollment rights, and it may be used to generate consumer authentication, certificates request agent, and codesigning certificate the use of the WebServer template.”

As defined above, CVE-2024-43451 was once additionally publicly disclosed.

Fresh updates from different corporations

Different distributors who launched updates or advisories in November 2024 come with:

• Adobe launched safety updates for a large number of packages, together with Photoshop, Illustrator, and Trade.
• Cisco releases safety updates for more than one merchandise, together with Cisco Telephones, Nexus Dashboard, Id Products and services Engine, and extra.
• Citrix releases safety updates for NetScaler ADC and NetScaler Gateway vulnerabilities. In addition they launched an replace for the Citrix Digital Apps and Desktops reported by way of Watchtowr.
• Dell releases safety updates for code execution and safety bypass flaws in SONiC OS.
• D-Hyperlink releases a safety replace for a vital DSL6740C flaw that permits amendment of account passwords.
• Google launched Chrome 131, which incorporates 12 safety fixes. No zero-days.
• Ivanti releases safety updates for twenty-five vulnerabilities in Ivanti Attach Safe (ICS), Ivanti Coverage Safe (IPS), Ivanti Safe Get admission to Consumer (ISAC).
• SAP releases safety updates for more than one merchandise as a part of November Patch Day.
• Schneider Electrical releases safety updates for flaws in Modicon M340, Momentum, and MC80 merchandise.
• Siemens launched a safety replace for a vital 10/10 flaw in TeleControl Server Fundamental tracked as CVE-2024-44102.

The November 2024 Patch Tuesday Safety Updates

Under is the entire listing of resolved vulnerabilities within the November 2024 Patch Tuesday updates.

To get right of entry to the whole description of every vulnerability and the techniques it impacts, you’ll view the complete file right here.

Replace 11/13/24: Modified choice of flaws to 89 as we prior to now integrated Edge flaws fastened on November 7.