Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 91 flaws

At the moment is Microsoft’s November 2024 Patch Tuesday, which incorporates safety updates for 91 flaws, together with 4 zero-days, two of that are actively exploited.

This Patch Tuesday mounted 4 important vulnerabilities, which embody two distant code execution and two elevation of privileges flaws.

The variety of bugs in every vulnerability class is listed beneath:

  • 26 Elevation of Privilege vulnerabilities
  • 2 Safety Function Bypass vulnerabilities
  • 52 Distant Code Execution vulnerabilities
  • 1 Data Disclosure vulnerability
  • 4 Denial of Service vulnerabilities
  • 3 Spoofing vulnerabilities

This depend doesn’t embody two Edge flaws that have been beforehand mounted on November seventh.

To be taught extra in regards to the non-security updates launched at the moment, you possibly can assessment our devoted articles on the brand new Home windows 11 KB5046617 and KB5046633 cumulative updates.

4 zero-days disclosed

This month’s Patch Tuesday fixes 4 zero-days, two of which have been actively exploited in assaults, and three have been publicly disclosed.

Microsoft classifies a zero-day flaw as one that’s publicly disclosed or actively exploited whereas no official repair is out there.

The 2 actively exploited zero-day vulnerabilities in at the moment’s updates are:

CVE-2024-43451 – NTLM Hash Disclosure Spoofing Vulnerability

Microsoft has mounted a vulnerability that exposes NTLM hashes to distant attackers with minimal interplay with a malicious file.

“This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user,” defined Microsoft.

“Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing could trigger this vulnerability,” continued Microsoft.

Microsoft says Israel Yeshurun of ClearSky Cyber Security found this vulnerability and that it was publicly disclosed, however didn’t share any additional particulars.

CVE-2024-49039 – Home windows Activity Scheduler Elevation of Privilege Vulnerability

A specifically crafted utility may very well be executed that elevates privilege to Medium Integrity degree.

“In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment,” defined Microsoft.

Microsoft says that exploiting this vulnerability would permit attackers to execute RPC capabilities which can be usually restricted to privileged accounts.

The flaw was found by Vlad Stolyarov and Bahare Sabouri of Google’s Risk Evaluation Group.

It’s not recognized how the flaw was exploited in assaults.

The opposite three vulnerabilities that have been publicly disclosed however not exploited in assaults are:

CVE-2024-49040 – Microsoft Trade Server Spoofing Vulnerability

Microsoft has mounted a Microsoft Trade vulnerability that permits menace actors to spoof the sender’s e-mail deal with in emails to native recipients.

“Microsoft is conscious of a vulnerability (CVE-2024-49040) that permits attackers to run spoofing assaults in opposition to Microsoft Trade Server,” explains a associated advisory by Microsoft.

“The vulnerability is caused by the current implementation of the P2 FROM header verification, which happens in transport.”

Beginning with this month’s Microsoft Trade safety updates, Microsoft is now detecting and flagging spoofed emails with an alert prepended to the e-mail physique that states, “Notice: This email appears to be suspicious. Do not trust the information, links, or attachments in this email without verifying the source through a trusted method.”

Microsoft says the flaw was found by Slonser at Solidlab, who publicly disclosed the flaw in this text.

CVE-2024-49019 – Lively Listing Certificates Providers Elevation of Privilege Vulnerability

Microsoft mounted a flaw that permits attackers to achieve area administrator privileges by abusing built-in default model 1 certificates templates.

“Verify you probably have printed any certificates created utilizing a model 1 certificates template the place the Supply of topic identify is about to “Equipped within the request” and the Enroll permissions are granted to a broader set of accounts, such as domain users or domain computers,” explains Microsoft.

“An example is the built-in Web Server template, but it is not vulnerable by default due to its restricted Enroll permissions.”

The flaw was found by Lou Scicchitano, Scot Berner, and Justin Bollinger with TrustedSec, who disclosed the “EKUwu” vulnerability in October.

“Using built-in default version 1 certificate templates, an attacker can craft a CSR to include application policies that are preferred over the configured Extended Key Usage attributes specified in the template,” reads TrustedSec’s report.

“The only requirement is enrollment rights, and it can be used to generate client authentication, certificate request agent, and codesigning certificates using the WebServer template.”

As defined above, CVE-2024-43451 was additionally publicly disclosed.

Current updates from different corporations

Different distributors who launched updates or advisories in November 2024 embody:

  • Adobe launched safety updates for quite a few functions, together with Photoshop, Illustrator, and Commerce.
  • Cisco releases safety updates for a number of merchandise, together with Cisco Telephones, Nexus Dashboard, Id Providers Engine, and extra.
  • Citrix releases safety updates for NetScaler ADC and NetScaler Gateway vulnerabilities. In addition they launched an replace for the Citrix Digital Apps and Desktops reported by Watchtowr.
  • Dell releases safety updates for code execution and safety bypass flaws in SONiC OS.
  • D-Hyperlink releases a safety replace for a important DSL6740C flaw that permits modification of account passwords.
  • Ivanti releases safety updates for twenty-five vulnerabilities in Ivanti Join Safe (ICS), Ivanti Coverage Safe (IPS), Ivanti Safe Entry Consumer (ISAC).
  • SAP releases safety updates for a number of merchandise as a part of November Patch Day.
  • Schneider Electrical releases safety updates for flaws in Modicon M340, Momentum, and MC80 merchandise.
  • Siemens launched a safety replace for a important 10/10 flaw in TeleControl Server Fundamental tracked as CVE-2024-44102.

The November 2024 Patch Tuesday Safety Updates

Under is the entire listing of resolved vulnerabilities within the November 2024 Patch Tuesday updates.

To entry the complete description of every vulnerability and the techniques it impacts, you possibly can view the full report right here.





























































































Tag CVE ID CVE Title Severity
.NET and Visible Studio CVE-2024-43499 .NET and Visible Studio Denial of Service Vulnerability Vital
.NET and Visible Studio CVE-2024-43498 .NET and Visible Studio Distant Code Execution Vulnerability Vital
Airlift.microsoft.com CVE-2024-49056 Airlift.microsoft.com Elevation of Privilege Vulnerability Vital
Azure CycleCloud CVE-2024-43602 Azure CycleCloud Distant Code Execution Vulnerability Vital
LightGBM CVE-2024-43598 LightGBM Distant Code Execution Vulnerability Vital
Microsoft Defender for Endpoint CVE-2024-5535 OpenSSL: CVE-2024-5535 SSL_select_next_proto buffer overread Vital
Microsoft Edge (Chromium-based) CVE-2024-10826 Chromium: CVE-2024-10826 Use after free in Household Experiences Unknown
Microsoft Edge (Chromium-based) CVE-2024-10827 Chromium: CVE-2024-10827 Use after free in Serial Unknown
Microsoft Trade Server CVE-2024-49040 Microsoft Trade Server Spoofing Vulnerability Vital
Microsoft Graphics Element CVE-2024-49031 Microsoft Workplace Graphics Distant Code Execution Vulnerability Vital
Microsoft Graphics Element CVE-2024-49032 Microsoft Workplace Graphics Distant Code Execution Vulnerability Vital
Microsoft Workplace Excel CVE-2024-49029 Microsoft Excel Distant Code Execution Vulnerability Vital
Microsoft Workplace Excel CVE-2024-49026 Microsoft Excel Distant Code Execution Vulnerability Vital
Microsoft Workplace Excel CVE-2024-49027 Microsoft Excel Distant Code Execution Vulnerability Vital
Microsoft Workplace Excel CVE-2024-49028 Microsoft Excel Distant Code Execution Vulnerability Vital
Microsoft Workplace Excel CVE-2024-49030 Microsoft Excel Distant Code Execution Vulnerability Vital
Microsoft Workplace SharePoint ADV240001 Microsoft SharePoint Server Protection in Depth Replace None
Microsoft Workplace Phrase CVE-2024-49033 Microsoft Phrase Safety Function Bypass Vulnerability Vital
Microsoft PC Supervisor CVE-2024-49051 Microsoft PC Supervisor Elevation of Privilege Vulnerability Vital
Microsoft Digital Arduous Drive CVE-2024-38264 Microsoft Digital Arduous Disk (VHDX) Denial of Service Vulnerability Vital
Microsoft Home windows DNS CVE-2024-43450 Home windows DNS Spoofing Vulnerability Vital
Position: Home windows Lively Listing Certificates Providers CVE-2024-49019 Lively Listing Certificates Providers Elevation of Privilege Vulnerability Vital
Position: Home windows Hyper-V CVE-2024-43633 Home windows Hyper-V Denial of Service Vulnerability Vital
Position: Home windows Hyper-V CVE-2024-43624 Home windows Hyper-V Shared Digital Disk Elevation of Privilege Vulnerability Vital
SQL Server CVE-2024-48998 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-48997 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-48993 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49001 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49000 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-48999 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49043 Microsoft.SqlServer.XEvent.Configuration.dll Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-43462 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-48995 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-48994 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-38255 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-48996 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-43459 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49002 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49013 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49014 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49011 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49012 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49015 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49018 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49021 Microsoft SQL Server Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49016 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49017 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49010 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49005 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49007 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49003 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49004 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49006 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49009 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
SQL Server CVE-2024-49008 SQL Server Native Consumer Distant Code Execution Vulnerability Vital
TorchGeo CVE-2024-49048 TorchGeo Distant Code Execution Vulnerability Vital
Visible Studio CVE-2024-49044 Visible Studio Elevation of Privilege Vulnerability Vital
Visible Studio Code CVE-2024-49050 Visible Studio Code Python Extension Distant Code Execution Vulnerability Vital
Visible Studio Code CVE-2024-49049 Visible Studio Code Distant Extension Elevation of Privilege Vulnerability Reasonable
Home windows CSC Service CVE-2024-43644 Home windows Consumer-Facet Caching Elevation of Privilege Vulnerability Vital
Home windows Defender Software Management (WDAC) CVE-2024-43645 Home windows Defender Software Management (WDAC) Safety Function Bypass Vulnerability Vital
Home windows DWM Core Library CVE-2024-43636 Win32k Elevation of Privilege Vulnerability Vital
Home windows DWM Core Library CVE-2024-43629 Home windows DWM Core Library Elevation of Privilege Vulnerability Vital
Home windows Kerberos CVE-2024-43639 Home windows Kerberos Distant Code Execution Vulnerability Vital
Home windows Kernel CVE-2024-43630 Home windows Kernel Elevation of Privilege Vulnerability Vital
Home windows NT OS Kernel CVE-2024-43623 Home windows NT OS Kernel Elevation of Privilege Vulnerability Vital
Home windows NTLM CVE-2024-43451 NTLM Hash Disclosure Spoofing Vulnerability Vital
Home windows Package deal Library Supervisor CVE-2024-38203 Home windows Package deal Library Supervisor Data Disclosure Vulnerability Vital
Home windows Registry CVE-2024-43641 Home windows Registry Elevation of Privilege Vulnerability Vital
Home windows Registry CVE-2024-43452 Home windows Registry Elevation of Privilege Vulnerability Vital
Home windows Safe Kernel Mode CVE-2024-43631 Home windows Safe Kernel Mode Elevation of Privilege Vulnerability Vital
Home windows Safe Kernel Mode CVE-2024-43646 Home windows Safe Kernel Mode Elevation of Privilege Vulnerability Vital
Home windows Safe Kernel Mode CVE-2024-43640 Home windows Kernel-Mode Driver Elevation of Privilege Vulnerability Vital
Home windows SMB CVE-2024-43642 Home windows SMB Denial of Service Vulnerability Vital
Home windows SMBv3 Consumer/Server CVE-2024-43447 Home windows SMBv3 Server Distant Code Execution Vulnerability Vital
Home windows Activity Scheduler CVE-2024-49039 Home windows Activity Scheduler Elevation of Privilege Vulnerability Vital
Home windows Telephony Service CVE-2024-43628 Home windows Telephony Service Distant Code Execution Vulnerability Vital
Home windows Telephony Service CVE-2024-43621 Home windows Telephony Service Distant Code Execution Vulnerability Vital
Home windows Telephony Service CVE-2024-43620 Home windows Telephony Service Distant Code Execution Vulnerability Vital
Home windows Telephony Service CVE-2024-43627 Home windows Telephony Service Distant Code Execution Vulnerability Vital
Home windows Telephony Service CVE-2024-43635 Home windows Telephony Service Distant Code Execution Vulnerability Vital
Home windows Telephony Service CVE-2024-43622 Home windows Telephony Service Distant Code Execution Vulnerability Vital
Home windows Telephony Service CVE-2024-43626 Home windows Telephony Service Elevation of Privilege Vulnerability Vital
Home windows Replace Stack CVE-2024-43530 Home windows Replace Stack Elevation of Privilege Vulnerability Vital
Home windows USB Video Driver CVE-2024-43643 Home windows USB Video Class System Driver Elevation of Privilege Vulnerability Vital
Home windows USB Video Driver CVE-2024-43449 Home windows USB Video Class System Driver Elevation of Privilege Vulnerability Vital
Home windows USB Video Driver CVE-2024-43637 Home windows USB Video Class System Driver Elevation of Privilege Vulnerability Vital
Home windows USB Video Driver CVE-2024-43634 Home windows USB Video Class System Driver Elevation of Privilege Vulnerability Vital
Home windows USB Video Driver CVE-2024-43638 Home windows USB Video Class System Driver Elevation of Privilege Vulnerability Vital
Home windows VMSwitch CVE-2024-43625 Microsoft Home windows VMSwitch Elevation of Privilege Vulnerability Vital
Home windows Win32 Kernel Subsystem CVE-2024-49046 Home windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Vital

Replace 9/11/24: Up to date to elucidate that solely three flaws have been actively exploited and why CVE-2024-43491 was marked as exploited.

Recent articles