What’s New Wednesday: A Summary of August 2024’s Patch Tuesday August 14, 2024 – Posted in: Cyber Security, IT Support, News, What's New Wednesdays – Tags: cybersecurity, Microsoft, Patch Tuesday, patching, WhatsNewWednesday

The Microsoft monthly security update release is published on the second Tuesday of each month. It’s a good idea to restart your PC on the following Wednesday – today. We may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

Yesterday’s Patch Tuesday included security updates for 89 flaws and 10 zero-day vulnerabilities. Overall Microsoft patched:

• 36 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 28 Remote Code Execution Vulnerabilities
• 8 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 7 Spoofing Vulnerabilities

There were 6 actively exploited and 3 publicly disclosed zero-day vulnerabilities patched:

CVE-2024-38178 – Scripting Engine Memory Corruption Vulnerability
the attack requires an authenticated client to click a link in Edge in IE mode in order for an unauthenticated attacker to initiate remote code execution, despite the pre-requisites it is being exploited.
CVE-2024-38193 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
an actively exploited flaw that allows attackers to gain SYSTEM privileges on Windows systems.
CVE-2024-38213 – Windows Mark of the Web Security Feature Bypass Vulnerability
an actively exploited bug that allows attackers to create files that bypass Windows Mark of the Web security alerts.
CVE-2024-38106 – Windows Kernel Elevation of Privilege Vulnerability
a Windows Kernel elevation of privileges flaw that gives SYSTEM privileges.
CVE-2024-38107 – Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
a flaw that gives attackers SYSTEM privileges on the Windows device.
CVE-2024-38189 – Microsoft Project Remote Code Execution Vulnerability
a Microsoft Project remote code execution vulnerability that requires security features to be disabled for exploitation, attackers would need to trick a user into opening the malicious file through phishing attacks or by luring users to websites hosting the file.
CVE-2024-38199 – Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
a publically disclosed vulnerability that allowed an unauthenticated attacker to send a specially crafted print task to a shared vulnerable Windows Line Printer Daemon (LPD) service across a network which could result in remote code execution on the server.
CVE-2024-21302 – Windows Secure Kernel Mode Elevation of Privilege Vulnerability
this flaw allowed attackers to gain elevated privileges to install malicious updates that unpatch fully updated Windows 10, Windows 11, and Windows Server systems to reintroduce old vulnerabilities.
CVE-2024-38200 – Microsoft Office Spoofing Vulnerability
exploited by tricking someone into opening a malicious file, which would force Office to make an outbound connection to a remote share where attackers could steal NTLM hashes.
CVE-2024-38202 – Windows Update Stack Elevation of Privilege Vulnerability
part of the Windows Downdate downgrade attack talk at Black Hat 2024, Microsoft is developing a security update to mitigate this threat, but it is not yet available.

Releases from other software providers include:

• 0.0.0. – Zero day flaw allows malicious websites to bypass browser security features and access services on a local network.
• Android – update fixes actively exploited RCE.
• CISA – warned of Cisco Smart Install (SMI) feature being abused in attacks.
• Cisco – warns of critical RCE flaws in end-of-life Small Business SPA 300 and SPA 500 series IP phones.
• GhostWrite – vulnerability lets unprivileged attackers read and write to the computer’s memory on T-Head XuanTie C910 and C920 RISC-V CPUs and control peripheral devices.
• Ivanti – security updates for critical vTM auth bypass with public exploit.
• SinkClose – a flaw lets attackers gain Ring -2 privileges on AMD CPUs.
• Linux SLUBStick – a flaw converts a limited heap vulnerability into an arbitrary memory read-and-write capability.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.