What’s New Wednesday: A Summary of March 2024’s Patch Tuesday March 13, 2024 – Posted in: IT Support, What's New Wednesdays
The Microsoft monthly security update release is published on the second Tuesday of each month. It’s a good idea to restart your PC on the following Wednesday – today. We may well restart some of your servers overnight this week if a patch requires it.
NEW THIS WEDNESDAY
Yesterday’s Patch Tuesday included security updates for 60 vulnerabilities – 18 remote code execution flaws and 2 critical vulnerabilities. Overall Microsoft patched:
- 3 Security Feature Bypass Vulnerabilities
- 18 Remote Code Execution Vulnerabilities
- 6 Information Disclosure Vulnerabilities
- 6 Denial of Service Vulnerabilities
- 2 Spoofing Vulnerabilities
There were no zero-day vulnerabilities this month, the major vulnerabilities patched were:
CVE-2024-21400 – Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
a vulnerability in Azure Kubernetes Service that could allow attackers to gain elevated privileges and steal credentials.
CVE-2024-26199 – Microsoft Office Elevation of Privilege Vulnerability
allowing any authenticated user to gain SYSTEM privileges.
CVE-2024-20671 – Microsoft Defender Security Feature Bypass Vulnerability
that could enable an attacker to prevent Microsoft Defender from starting.
CVE-2024-21411 – Skype for Consumer Remote Code Execution Vulnerability
a remote code execution vulnerability Skype for Consumer that can be triggered by a malicious link or image.
Releases from other software providers include:
- AnyCubic – new Kobra 2 firmware to fix a zero-day vulnerability exploited last month.
- Apple – security updates to fix two iOS zero-days.
- Cisco – security updates for multiple products.
- Fortinet – security updates for FortiOS & FortiProxy.
- Google – Android March 2024 security updates.
- Intel – an advisory on a new Register File Data Sampling (RFDS) microarchitectural vulnerability.
- QNAP – security updates for an authentication bypass in QTS, QuTS hero, QuTScloud, and myQNAPcloud.
- SAP – March 2024 Patch Day updates.
- VMware – security updates to fix critical sandbox escape vulnerabilities in VMware ESXi, Workstation, Fusion, and Cloud Foundation.
FULL LIST OF MICROSOFT PATCHES
| Vulnerable Service | CVE ID | Title | Severity |
| .NET | CVE-2024-21392 | .NET and Visual Studio Denial of Service Vulnerability | Important |
| Azure Data Studio | CVE-2024-26203 | Azure Data Studio Elevation of Privilege Vulnerability | Important |
| Azure SDK | CVE-2024-21421 | Azure SDK Spoofing Vulnerability | Important |
| Intel | CVE-2023-28746 | Intel: CVE-2023-28746 Register File Data Sampling (RFDS) | Important |
| Microsoft Authenticator | CVE-2024-21390 | Microsoft Authenticator Elevation of Privilege Vulnerability | Important |
| Microsoft Azure Kubernetes Service | CVE-2024-21400 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability | Important |
| Microsoft Django Backend for SQL Server | CVE-2024-26164 | Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability | Important |
| Microsoft Dynamics | CVE-2024-21419 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | Important |
| Microsoft Edge (Chromium-based) | CVE-2024-2174 | Chromium: CVE-2024-2174 Inappropriate implementation in V8 | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2024-2173 | Chromium: CVE-2024-2173 Out of bounds memory access in V8 | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2024-2176 | Chromium: CVE-2024-2176 Use after free in FedCM | Unknown |
| Microsoft Edge for Android | CVE-2024-26167 | Microsoft Edge for Android Spoofing Vulnerability | Unknown |
| Microsoft Exchange Server | CVE-2024-26198 | Microsoft Exchange Server Remote Code Execution Vulnerability | Important |
| Microsoft Graphics Component | CVE-2024-21437 | Windows Graphics Component Elevation of Privilege Vulnerability | Important |
| Microsoft Intune | CVE-2024-26201 | Microsoft Intune Linux Agent Elevation of Privilege Vulnerability | Important |
| Microsoft Office | CVE-2024-26199 | Microsoft Office Elevation of Privilege Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2024-21426 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important |
| Microsoft QUIC | CVE-2024-26190 | Microsoft QUIC Denial of Service Vulnerability | Important |
| Microsoft Teams for Android | CVE-2024-21448 | Microsoft Teams for Android Information Disclosure Vulnerability | Important |
| Microsoft WDAC ODBC Driver | CVE-2024-21451 | Microsoft ODBC Driver Remote Code Execution Vulnerability | Important |
| Microsoft WDAC OLE DB provider for SQL | CVE-2024-21441 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | Important |
| Microsoft WDAC OLE DB provider for SQL | CVE-2024-26161 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | Important |
| Microsoft WDAC OLE DB provider for SQL | CVE-2024-26166 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | Important |
| Microsoft WDAC OLE DB provider for SQL | CVE-2024-21444 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | Important |
| Microsoft WDAC OLE DB provider for SQL | CVE-2024-21450 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | Important |
| Microsoft Windows SCSI Class System File | CVE-2024-21434 | Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability | Important |
| Open Management Infrastructure | CVE-2024-21330 | Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability | Important |
| Open Management Infrastructure | CVE-2024-21334 | Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | Important |
| Outlook for Android | CVE-2024-26204 | Outlook for Android Information Disclosure Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2024-21407 | Windows Hyper-V Remote Code Execution Vulnerability | Critical |
| Role: Windows Hyper-V | CVE-2024-21408 | Windows Hyper-V Denial of Service Vulnerability | Critical |
| Skype for Consumer | CVE-2024-21411 | Skype for Consumer Remote Code Execution Vulnerability | Important |
| Software for Open Networking in the Cloud (SONiC) | CVE-2024-21418 | Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability | Important |
| Visual Studio Code | CVE-2024-26165 | Visual Studio Code Elevation of Privilege Vulnerability | Important |
| Windows AllJoyn API | CVE-2024-21438 | Microsoft AllJoyn API Denial of Service Vulnerability | Important |
| Windows Cloud Files Mini Filter Driver | CVE-2024-26160 | Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability | Important |
| Windows Composite Image File System | CVE-2024-26170 | Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability | Important |
| Windows Compressed Folder | CVE-2024-26185 | Windows Compressed Folder Tampering Vulnerability | Important |
| Windows Defender | CVE-2024-20671 | Microsoft Defender Security Feature Bypass Vulnerability | Important |
| Windows Error Reporting | CVE-2024-26169 | Windows Error Reporting Service Elevation of Privilege Vulnerability | Important |
| Windows Hypervisor-Protected Code Integrity | CVE-2024-21431 | Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability | Important |
| Windows Installer | CVE-2024-21436 | Windows Installer Elevation of Privilege Vulnerability | Important |
| Windows Kerberos | CVE-2024-21427 | Windows Kerberos Security Feature Bypass Vulnerability | Important |
| Windows Kernel | CVE-2024-26177 | Windows Kernel Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2024-26176 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2024-26174 | Windows Kernel Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2024-26182 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2024-26181 | Windows Kernel Denial of Service Vulnerability | Important |
| Windows Kernel | CVE-2024-26178 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2024-26173 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2024-21443 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows NTFS | CVE-2024-21446 | NTFS Elevation of Privilege Vulnerability | Important |
| Windows ODBC Driver | CVE-2024-21440 | Microsoft ODBC Driver Remote Code Execution Vulnerability | Important |
| Windows ODBC Driver | CVE-2024-26162 | Microsoft ODBC Driver Remote Code Execution Vulnerability | Important |
| Windows ODBC Driver | CVE-2024-26159 | Microsoft ODBC Driver Remote Code Execution Vulnerability | Important |
| Windows OLE | CVE-2024-21435 | Windows OLE Remote Code Execution Vulnerability | Important |
| Windows Print Spooler Components | CVE-2024-21433 | Windows Print Spooler Elevation of Privilege Vulnerability | Important |
| Windows Standards-Based Storage Management Service | CVE-2024-26197 | Windows Standards-Based Storage Management Service Denial of Service Vulnerability | Important |
| Windows Telephony Server | CVE-2024-21439 | Windows Telephony Server Elevation of Privilege Vulnerability | Important |
| Windows Update Stack | CVE-2024-21432 | Windows Update Stack Elevation of Privilege Vulnerability | Important |
| Windows USB Hub Driver | CVE-2024-21429 | Windows USB Hub Driver Remote Code Execution Vulnerability | Important |
| Windows USB Print Driver | CVE-2024-21442 | Windows USB Print Driver Elevation of Privilege Vulnerability | Important |
| Windows USB Print Driver | CVE-2024-21445 | Windows USB Print Driver Elevation of Privilege Vulnerability | Important |
| Windows USB Serial Driver | CVE-2024-21430 | Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability | Important |
GLOSSARY
- Authentication – proving who you are so you can be given access to what you need/have rights to.
- MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
- Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
- Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
- Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
- Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
- DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
- Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
- CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
- Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
- Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
- Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
- Information Disclosure Vulnerabilities – allow the wrong people access to your data.
- Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
- Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.
If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.