In its closing Patch Tuesday of 2024, Microsoft has launched a major safety replace addressing a complete of 71 vulnerabilities, together with 16 crucial vulnerabilities and 1 zero-day.
This December replace marks an important milestone in Microsoft’s ongoing efforts to boost the safety of its merchandise and shield customers from potential cyber threats.
Crucial Zero-Day Vulnerability Exploited: CVE-2024-49138
CVE-2024-49138, a zero-day vulnerability, was actively exploited earlier than receiving a patch in Microsoft’s December 2024 Patch Tuesday replace. This crucial flaw, affecting the Home windows Widespread Log File System Driver, is categorized as an Elevation of Privilege vulnerability.
The vulnerability, found by CrowdStrike’s Superior Analysis Staff, allows attackers to acquire SYSTEM-level privileges on Home windows units, doubtlessly granting them full management over the compromised system.
Though it has been confirmed that this vulnerability was exploited within the wild, particulars in regards to the strategies used for exploitation stay undisclosed.
Microsoft’s December 2024 replace addresses this vulnerability, and customers are strongly inspired to use the patch instantly to guard their methods.
Crucial Vulnerabilities Patched
The 16 crucial vulnerabilities patched this month primarily have an effect on Home windows Distant Desktop Providers, Home windows Hyper-V, and the Light-weight Listing Entry Protocol (LDAP) Shopper.
If exploited, these flaws may result in distant code execution, doubtlessly permitting attackers to achieve full management of affected methods.
Leveraging 2024 MITRE ATT&CK Outcomes for SME & MSP Cybersecurity Leaders – Attend Free Webinar
Among the many most extreme vulnerabilities are:
- CVE-2024-49106, CVE-2024-49108, and CVE-2024-49115: Distant Code Execution Vulnerabilities in Home windows Distant Desktop Providers
- CVE-2024-49117: A Distant Code Execution vulnerability in Home windows Hyper-V
- CVE-2024-49124: A Distant Code Execution vulnerability within the Light-weight Listing Entry Protocol (LDAP) Shopper
Microsoft urges customers and system directors to use these patches instantly to mitigate the chance of potential assaults.
The Cybersecurity and Infrastructure Safety Company (CISA) has added CVE-2024-43451 to its Recognized Exploited Vulnerabilities Catalog, emphasizing the urgency of patching this flaw.
Along with the crucial and zero-day vulnerabilities, Microsoft has patched a variety of essential safety points throughout its product lineup. These embody:
- 30 Distant Code Execution vulnerabilities
- 28 Elevation of Privilege vulnerabilities
- 4 Denial of Service vulnerabilities
- 1 Spoofing vulnerabilities
- 7 Data Disclosure vulnerability
- 1 Protection in Depth
Influence on Enterprise Programs
The December Patch Tuesday replace is especially important for enterprise customers. IT directors ought to prioritize testing and deploying these patches, particularly these affecting Home windows Server, Alternate Server, and Lively Listing providers.
72 Vulnerabilities Fastened in Microsoft Patch Tuesday, December
| CVE Quantity | CVE Title | Influence |
| CVE-2024-49106 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49108 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49115 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49117 | Home windows Hyper-V Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49119 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49120 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49122 | Microsoft Message Queuing (MSMQ) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49123 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49124 | Light-weight Listing Entry Protocol (LDAP) Shopper Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49126 | Home windows Native Safety Authority Subsystem Service (LSASS) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49132 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49112 | Home windows Light-weight Listing Entry Protocol (LDAP) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49116 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49118 | Microsoft Message Queuing (MSMQ) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49127 | Home windows Light-weight Listing Entry Protocol (LDAP) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49128 | Home windows Distant Desktop Providers Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-38033 | PowerShell Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-43594 | System Middle Operations Supervisor Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49057 | Microsoft Defender for Endpoint on Android Spoofing Vulnerability | Spoofing |
| CVE-2024-49059 | Microsoft Workplace Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49064 | Microsoft SharePoint Data Disclosure Vulnerability | Data Disclosure |
| CVE-2024-49068 | Microsoft SharePoint Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49069 | Microsoft Excel Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49070 | Microsoft SharePoint Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49073 | Home windows Cell Broadband Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49074 | Home windows Kernel-Mode Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49084 | Home windows Kernel Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49085 | Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49086 | Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49087 | Home windows Cell Broadband Driver Data Disclosure Vulnerability | Data Disclosure |
| CVE-2024-49089 | Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49091 | Home windows Area Title Service Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49092 | Home windows Cell Broadband Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49093 | Home windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49094 | Wi-fi Vast Space Community Service (WwanSvc) Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49096 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | Denial of Service |
| CVE-2024-49097 | Home windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49098 | Home windows Wi-fi Vast Space Community Service (WwanSvc) Data Disclosure Vulnerability | Data Disclosure |
| CVE-2024-49099 | Home windows Wi-fi Vast Space Community Service (WwanSvc) Data Disclosure Vulnerability | Data Disclosure |
| CVE-2024-49101 | Wi-fi Vast Space Community Service (WwanSvc) Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49102 | Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49103 | Home windows Wi-fi Vast Space Community Service (WwanSvc) Data Disclosure Vulnerability | Data Disclosure |
| CVE-2024-49104 | Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49107 | WmsRepair Service Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49111 | Wi-fi Vast Space Community Service (WwanSvc) Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49121 | Home windows Light-weight Listing Entry Protocol (LDAP) Denial of Service Vulnerability | Denial of Service |
| CVE-2024-49125 | Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49129 | Home windows Distant Desktop Gateway (RD Gateway) Denial of Service Vulnerability | Denial of Service |
| CVE-2024-49142 | Microsoft Entry Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-43600 | Microsoft Workplace Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49062 | Microsoft SharePoint Data Disclosure Vulnerability | Data Disclosure |
| CVE-2024-49063 | Microsoft/Muzic Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49065 | Microsoft Workplace Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49072 | Home windows Process Scheduler Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49075 | Home windows Distant Desktop Providers Denial of Service Vulnerability | Denial of Service |
| CVE-2024-49076 | Home windows Virtualization-Based mostly Safety (VBS) Enclave Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49077 | Home windows Cell Broadband Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49078 | Home windows Cell Broadband Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49079 | Enter Methodology Editor (IME) Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49080 | Home windows IP Routing Administration Snapin Distant Code Execution Vulnerability | Distant Code Execution |
| CVE-2024-49081 | Wi-fi Vast Space Community Service (WwanSvc) Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49082 | Home windows File Explorer Data Disclosure Vulnerability | Data Disclosure |
| CVE-2024-49083 | Home windows Cell Broadband Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49088 | Home windows Widespread Log File System Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49090 | Home windows Widespread Log File System Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49095 | Home windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49109 | Wi-fi Vast Space Community Service (WwanSvc) Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49110 | Home windows Cell Broadband Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49113 | Home windows Light-weight Listing Entry Protocol (LDAP) Denial of Service Vulnerability | Denial of Service |
| CVE-2024-49114 | Home windows Cloud Information Mini Filter Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| CVE-2024-49138 | Home windows Widespread Log File System Driver Elevation of Privilege Vulnerability | Elevation of Privilege |
| ADV240002 | Microsoft Workplace Protection in Depth Replace | Protection in Depth |
Microsoft has additionally introduced a preview program for hotpatching each Home windows 11 Enterprise 24H2 and Home windows 365 Enterprise. This new mannequin goals to cut back required reboots from twelve to 4 per yr, doubtlessly minimizing downtime for enterprise methods.
As we strategy the top of 2024, Microsoft continues to advance its Safe Future Initiative. The corporate is getting ready for the discharge of a brand new working system in 2025, coinciding with Home windows 10 getting into Prolonged Safety Replace (ESU) assist.
This new OS is anticipated to function a safer kernel, tighter controls on purposes and drivers, and enhanced AI capabilities.
The December 2024 Patch Tuesday underscores the continued significance of immediate safety updates. As cyber threats proceed to evolve, common patching stays a crucial protection towards potential exploits.
Customers and organizations are strongly suggested to use these updates as quickly as attainable to make sure the safety and integrity of their methods.
Examine Actual-World Malicious Hyperlinks, Malware & Phishing Assaults With ANY.RUN – Strive for Free