Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws

In the present day is Microsoft’s October 2024 Patch Tuesday, which incorporates safety updates for 118 flaws, together with 5 publicly disclosed zero-days, two of that are actively exploited.

This Patch Tuesday mounted three important vulnerabilities, all distant code execution flaws.

The variety of bugs in every vulnerability class is listed beneath:

• 28 Elevation of Privilege vulnerabilities
• 7 Safety Characteristic Bypass vulnerabilities
• 43 Distant Code Execution vulnerabilities
• 6 Info Disclosure vulnerabilities
• 26 Denial of Service vulnerabilities
• 7 Spoofing vulnerabilities

This depend doesn’t embody three Edge flaws that had been beforehand mounted on October third.

To be taught extra concerning the non-security updates launched at this time, you may assessment our devoted articles on the brand new Home windows 11 KB5044284 and KB5044285 cumulative updates and the Home windows 10 KB5044273 replace.

4 zero-days disclosed

This month’s Patch Tuesday fixes 5 zero-days, two of which had been actively exploited in assaults, and all 5 had been publicly disclosed.

Microsoft classifies a zero-day flaw as one that’s publicly disclosed or actively exploited whereas no official repair is out there.

The 2 actively exploited zero-day vulnerabilities in at this time’s updates are:

CVE-2024-43573 – Home windows MSHTML Platform Spoofing Vulnerability

Whereas Microsoft has not shared any detailed details about this bug or the way it’s exploited, they did state it concerned the MSHTML platform, beforehand utilized by Web Explorer and Legacy Microsoft Edge, whose parts are nonetheless put in in Home windows.

“While Microsoft has announced retirement of the Internet Explorer 11 application on certain platforms and the Microsoft Edge Legacy application is deprecated, the underlying MSHTML, EdgeHTML, and scripting platforms are still supported,” defined Microsoft.

“The MSHTML platform is used by Internet Explorer mode in Microsoft Edge as well as other applications through WebBrowser control. The EdgeHTML platform is used by WebView and some UWP applications. The scripting platforms are used by MSHTML and EdgeHTML but can also be used by other legacy applications.”

Whereas not confirmed, this could possibly be a bypass of a earlier vulnerability that abused MSHTML to spoof file extensions in alerts displayed when opening recordsdata. An analogous MSHTML spoofing flaw was disclosed final month when assaults utilized Braille characters in filenames to spoof PDF recordsdata.

Microsoft has not shared who disclosed the vulnerability.

CVE-2024-43572 – Microsoft Administration Console Distant Code Execution Vulnerability

This flaw allowed malicious Microsoft Saved Console (MSC) recordsdata to carry out distant code execution on weak units.

Microsoft mounted the flaw by stopping untrusted MSC recordsdata from being opened.

“The security update will prevent untrusted Microsoft Saved Console (MSC) files from being opened to protect customers against the risks associated with this vulnerability,” defined Microsoft.

It’s unknown how this flaw was actively exploited in assaults. 

Microsoft says the bug was disclosed by “Andres and Shady”.

Microsoft says that each of those had been additionally publicly disclosed.

The opposite three vulnerabilities that had been publicly disclosed however not exploited in assaults are:

CVE-2024-6197 – Open Supply Curl Distant Code Execution Vulnerability

Microsoft mounted a libcurl distant code execution flaw that might trigger instructions to be executed when Curl makes an attempt to hook up with a malicious server.

“The vulnerable code path can be triggered by a malicious server offering an especially crafted TLS certificate,” explains a Curl safety advisory.

Microsoft mounted the flaw by updating the libcurl library utilized by the Curl executable bundled with Home windows.

The flaw was found by a safety researcher named “z2_,” who shared technical particulars in a HackerOne report.

CVE-2024-20659 – Home windows Hyper-V Safety Characteristic Bypass Vulnerability

Microsoft mounted a UEFI bypass that might permit attackers to compromised the hypervisor and kernel.

“This Hypervisor vulnerability relates to Virtual Machines within a Unified Extensible Firmware Interface (UEFI) host machine,” explains Microsoft.

“On some specific hardware it might be possible to bypass the UEFI, which could lead to the compromise of the hypervisor and the secure kernel.”

Microsoft says that an attacker wants bodily entry to the machine and should reboot it to use the flaw.

The flaw was found by Francisco Falcón and Iván Arce of Quarkslab however it isn’t identified the place it was publicly disclosed.

CVE-2024-43583 – Winlogon Elevation of Privilege Vulnerability

Microsoft mounted an elevation of privileges flaw that might give attackers SYSTEM privileges in Home windows.

To be protected against this flaw, Microsoft says that admins should take further actions.

“To address this vulnerability, ensure that a Microsoft first-party IME is enabled on your device,” explains Microsoft.

“By doing so, you can help protect your device from potential vulnerabilities associated with a third-party (3P) IME during the sign in process.”

Microsoft says wh1tc & Zhiniang Peng of pwnull found the failings.

Current updates from different firms

Different distributors who launched updates or advisories in October 2024 embody:

The October 2024 Patch Tuesday Safety Updates

Under is the entire listing of resolved vulnerabilities within the October 2024 Patch Tuesday updates.

To entry the total description of every vulnerability and the methods it impacts, you may view the full report right here.

Replace 9/11/24: Up to date to elucidate that solely three flaws had been actively exploited and why CVE-2024-43491 was marked as exploited.