What’s New Wednesday: A Summary of November 2024’s Patch Tuesday November 13, 2024 – Posted in: Cyber Security, IT Support, News, What's New Wednesdays – Tags: Cyber Security, cybersecurity, it support, ITServices, ITSupport, Patch Tuesday, patching, WhatsNewWednesday

The Microsoft monthly security update release is published on the second Tuesday of each month. It’s a good idea to restart your PC on the following Wednesday – today. We may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

This month’s Patch Tuesday included security updates for 91 flaws including 4 zero-day vulnerabilities. Overall Microsoft patched:

• 26 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 52 Remote Code Execution Vulnerabilities
• 1 Information Disclosure Vulnerabilities
• 4 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

There were 4 zero-day vulnerabilities patched, 2 of which were actively exploited:

CVE-2024-43451 – NTLM Hash Disclosure Spoofing Vulnerability
a vulnerability that exposes NTLM hashes to remote attackers with minimal interaction with a malicious file such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing could trigger.
CVE-2024-49039 – Windows Task Scheduler Elevation of Privilege Vulnerability
A specially crafted application could be executed that elevates privilege to Medium Integrity level, exploiting this vulnerability would allow attackers to execute RPC functions that are normally restricted to privileged accounts.
CVE-2024-49040 – Microsoft Exchange Server Spoofing Vulnerability
a Microsoft Exchange vulnerability that allows threat actors to spoof the sender’s email address in emails to local recipients.
CVE-2024-49019 – Active Directory Certificate Services Elevation of Privilege Vulnerability
a flaw that allows attackers to gain domain administrator privileges by abusing built-in default version 1 certificate templates.

Releases from other software providers include:

• Adobe – security updates for applications, including Photoshop, Illustrator and Commerce.
• Cisco – security updates for products, including Cisco Phones, Nexus Dashboard, Identity Services Engine and more.
• Citrix – security updates for NetScaler ADC and NetScaler Gateway vulnerabilities, as well as an update for the Citrix Virtual Apps and Desktops.
• Dell – security updates for code execution and security bypass flaws in SONiC OS.
• D-Link – a security update for a critical DSL6740C flaw that allows modification of account passwords.
• Google – Chrome 131, which includes 12 security fixes.
• Ivanti – security updates for 25 vulnerabilities in Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), Ivanti Secure Access Client (ISAC).
• SAP – security updates for multiple products.
• Schneider Electric – security updates for flaws in Modicon M340, Momentum, and MC80 products.
• Siemens – a security update for a critical 10/10 flaw in TeleControl Server Basic tracked as CVE-2024-44102.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.