What’s New Wednesday: A Summary of May 2024’s Patch Tuesday May 15, 2024 – Posted in: IT Support, News, What's New Wednesdays – Tags: cybersecurity, ITSupport, Patch Tuesday, patching, SoftwareSupport, WhatsNewWednesday

The Microsoft monthly security update release is published on the second Tuesday of each month. It’s a good idea to restart your PC on the following Wednesday – today. We may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

Yesterday’s Patch Tuesday included security updates for 61 flaws, 1 critical vulnerability and 17 elevation of privilege vulnerabilities. Overall Microsoft patched:

• 17 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 27 Remote Code Execution Vulnerabilities
• 7 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

There were 3 zero-day vulnerabilities patched, both have been actively exploited:
CVE-2024-30040 – Windows MSHTML Platform Security Feature Bypass Vulnerability
an attacker who exploited this vulnerability could run code on a device by convincing a user to open a malicious document, allowing them to execute arbitrary code in the context of the user.
CVE-2024-30051 – Windows DWM Core Library Elevation of Privilege Vulnerability
an actively exploited Windows DWM Core Library flaw that provides SYSTEM privileges, attackers who successfully exploited this vulnerability could gain privileges to make significant changes to a device.
CVE-2024-30046 – Microsoft Visual Studio Denial of Service Flaw
a publicly disclosed flaw that would allow attackers to bring down Microsoft Visual Studio services by flooding the service with requests.

Releases from other software providers include:

• Adobe – security updates for After Effects, Photoshop, Commerce, InDesign, and more.
• Apple – backported an RTKit zero-day to older devices and fixed a Safari WebKit zero-day flaw exploited at Pwn2Own.
• Cisco – security updates for its IP phone products.
• Citrix – urged Xencenter admins to manually fix Putty flaw, which can be used to steal an admin’s private SSH key.
• F5 – security updates for two high-severity BIG-IP Next Central Manager API flaws.
• Google – an emergency update to fix the sixth zero-day of 2024.
• TinyProxy – a critical remote code execution flaw that was disclosed by Cisco.
• VMware – three zero-day bugs exploited at Pwn2Own 2024.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.