Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws

Right this moment is Microsoft’s October 2024 Patch Tuesday, which incorporates safety updates for 118 flaws, together with 5 publicly disclosed zero-days, two of that are actively exploited.

This Patch Tuesday fastened three important vulnerabilities, all distant code execution flaws.

The variety of bugs in every vulnerability class is listed under:

• 28 Elevation of Privilege vulnerabilities
• 7 Safety Function Bypass vulnerabilities
• 43 Distant Code Execution vulnerabilities
• 6 Info Disclosure vulnerabilities
• 26 Denial of Service vulnerabilities
• 7 Spoofing vulnerabilities

This rely doesn’t embody three Edge flaws that have been beforehand fastened on October third.

To study extra concerning the non-security updates launched at the moment, you may evaluate our devoted articles on the brand new Home windows 11 KB5044284 and KB5044285 cumulative updates and the Home windows 10 KB5044273 replace.

4 zero-days disclosed

This month’s Patch Tuesday fixes 5 zero-days, two of which have been actively exploited in assaults, and all 5 have been publicly disclosed.

Microsoft classifies a zero-day flaw as one that’s publicly disclosed or actively exploited whereas no official repair is offered.

The 2 actively exploited zero-day vulnerabilities in at the moment’s updates are:

CVE-2024-43573 – Home windows MSHTML Platform Spoofing Vulnerability

Whereas Microsoft has not shared any detailed details about this bug or the way it’s exploited, they did state it concerned the MSHTML platform, beforehand utilized by Web Explorer and Legacy Microsoft Edge, whose elements are nonetheless put in in Home windows.

“Whereas Microsoft has introduced retirement of the Web Explorer 11 utility on sure platforms and the Microsoft Edge Legacy utility is deprecated, the underlying MSHTML, EdgeHTML, and scripting platforms are nonetheless supported,” defined Microsoft.

“The MSHTML platform is utilized by Web Explorer mode in Microsoft Edge in addition to different functions by WebBrowser management. The EdgeHTML platform is utilized by WebView and a few UWP functions. The scripting platforms are utilized by MSHTML and EdgeHTML however will also be utilized by different legacy functions.”

Whereas not confirmed, this might be a bypass of a earlier vulnerability that abused MSHTML to spoof file extensions in alerts displayed when opening information. The same MSHTML spoofing flaw was disclosed final month when assaults utilized Braille characters in filenames to spoof PDF information.

Microsoft has not shared who disclosed the vulnerability.

CVE-2024-43572 – Microsoft Administration Console Distant Code Execution Vulnerability

This flaw allowed malicious Microsoft Saved Console (MSC) information to carry out distant code execution on susceptible gadgets.

Microsoft fastened the flaw by stopping untrusted MSC information from being opened.

“The safety replace will stop untrusted Microsoft Saved Console (MSC) information from being opened to guard prospects in opposition to the dangers related to this vulnerability,” defined Microsoft.

It’s unknown how this flaw was actively exploited in assaults. 

Microsoft says the bug was disclosed by “Andres and Shady”.

Microsoft says that each of those have been additionally publicly disclosed.

The opposite three vulnerabilities that have been publicly disclosed however not exploited in assaults are:

CVE-2024-6197 – Open Supply Curl Distant Code Execution Vulnerability

Microsoft fastened a libcurl distant code execution flaw that might trigger instructions to be executed when Curl makes an attempt to connect with a malicious server.

“The susceptible code path could be triggered by a malicious server providing an particularly crafted TLS certificates,” explains a Curl safety advisory.

Microsoft fastened the flaw by updating the libcurl library utilized by the Curl executable bundled with Home windows.

The flaw was found by a safety researcher named “z2_,” who shared technical particulars in a HackerOne report.

CVE-2024-20659 – Home windows Hyper-V Safety Function Bypass Vulnerability

Microsoft fastened a UEFI bypass that might enable attackers to compromised the hypervisor and kernel.

“This Hypervisor vulnerability pertains to Digital Machines inside a Unified Extensible Firmware Interface (UEFI) host machine,” explains Microsoft.

“On some particular {hardware} it is likely to be doable to bypass the UEFI, which might result in the compromise of the hypervisor and the safe kernel.”

Microsoft says that an attacker wants bodily entry to the system and should reboot it to use the flaw.

The flaw was found by Francisco Falcón and Iván Arce of Quarkslab however it isn’t identified the place it was publicly disclosed.

CVE-2024-43583 – Winlogon Elevation of Privilege Vulnerability

Microsoft fastened an elevation of privileges flaw that might give attackers SYSTEM privileges in Home windows.

To be protected against this flaw, Microsoft says that admins should take further actions.

“To handle this vulnerability, be certain that a Microsoft first-party IME is enabled in your system,” explains Microsoft.

“By doing so, you may assist shield your system from potential vulnerabilities related to a third-party (3P) IME through the register course of.”

Microsoft says wh1tc & Zhiniang Peng of pwnull found the issues.

Current updates from different corporations

Different distributors who launched updates or advisories in October 2024 embody:

The October 2024 Patch Tuesday Safety Updates

Beneath is the entire listing of resolved vulnerabilities within the October 2024 Patch Tuesday updates.

To entry the total description of every vulnerability and the techniques it impacts, you may view the full report right here.

Replace 9/11/24: Up to date to elucidate that solely three flaws have been actively exploited and why CVE-2024-43491 was marked as exploited.