What’s New Wednesday: A Summary of July 2024’s Patch Tuesday July 11, 2024 – Posted in: IT Support, What's New Wednesdays – Tags: cybersecurity, ITSupport, Patch Tuesday, patching, WhatsNewWednesday

The Microsoft monthly security update release is published on the second Tuesday of each month. It’s a good idea to restart your PC on the following Wednesday – today. We may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

Yesterday’s Patch Tuesday included security updates for 51 flaws, 18 remote code execution vulnerabilities and 1 publicaly disclosed zero-day vulnerability. Overall Microsoft patched:

• 26 Elevation of Privilege Vulnerabilities
• 24 Security Feature Bypass Vulnerabilities
• 59 Remote Code Execution Vulnerabilities
• 9 Information Disclosure Vulnerabilities
• 17 Denial of Service Vulnerabilities
• 7 Spoofing Vulnerabilities

There was one zero-day vulnerability patched:
CVE-2024-38080 – Windows Hyper-V Elevation of Privilege Vulnerability
an actively exploited Hyper-V elevation of privileges vulnerability that could give attackers SYSTEM privileges.
CVE-2024-38112 – Windows MSHTML Platform Spoofing Vulnerability
an actively exploited Windows MSHTML spoofing vulnerability that could be used if an attacker had sent the victim a malicious file that the victim would have to execute.
CVE-2024-35264 – .NET and Visual Studio Remote Code Execution Vulnerability
a publicly disclosed .NET and Visual Studio remote code execution vulnerability that allows an attacker to create a race condition closing by closing an http/3 stream while the request body is being processed leading to. This could result in remote code execution.
CVE-2024-37985 – Arm: CVE-2024-37985 Systematic Identification and Characterization of Proprietary Prefetchers
an attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server, successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation.

Releases from other software providers include:

• Adobe – security updates for Premiere Pro, InDesign, and Bridge.
• Cisco – disclosed an NX-OS Software CLI command Injection vulnerability that was exploited in attacks.
• Citrix – fixed flaws in Windows Virtual Delivery Agent and the Citrix Workspace app.
• GhostScript – a remote code execution flaw fixed in May 2024 is now being exploited in attacks.
• Fortinet – fixed multiple vulnerabilities in FortiOS and other products.
• Firefox – released Firefox 128 with fixes for multiple vulnerabilities.
• OpenSSH – fixed new regreSSHion RCE vulnerability. A second similar vulnerability tracked as CVE-2024-6409 was disclosed yesterday as well.
• VMware – fixed an HTML injection vulnerability in Cloud Director.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.