May 2024 – Microsoft Patch Tuesday highlights

Background:

Microsoft has fixed two zero-day vulnerabilities that are known to be exploited in the wild in this month’s security patches. Additionally, Microsoft fixed five flaws in the Chrome-based Microsoft Edge. This month, the vulnerabilities were patched early.

Updates for vulnerabilities in Microsoft Office and Components, Power BI, Visual Studio, Windows Cloud Files Mini Filter Driver, Windows Common Log File System Driver, Windows Cryptographic Services, and more are included in the May edition of Microsoft Patch Tuesday.

Microsoft has addressed a number of vulnerabilities in various software programs, including information disclosure, remote code execution (RCE), spoofing, elevation of privilege (EoP), denial of service (DoS), and security feature bypass.

The May 2024 Microsoft vulnerabilities are classified as follows:

CVE-2024-30040:

One browser engine that is often used in conjunction with Internet Explorer is Windows MSHTML. Despite the fact that Microsoft is continually patching MSHTML vulnerabilities, the Internet Explorer (IE) 11 desktop program is no longer supported.

OLE mitigations in Microsoft Office and Microsoft 365, which shield users from weak COM/OLE controls, can be circumvented by the vulnerability. This vulnerability could be used by an unauthenticated attacker to execute code by tricking a user into opening a malicious document.

This CVE has been added by CISA to its catalog of known exploited vulnerabilities, and users are asked to fix it by May 6, 2024. The connection between CVE-2024-30051 and QakBot, a potent malware threat that is always changing, increases the risk.

CVE-2024-30051:

System managers such as the Microsoft Windows Desktop Window Manager (DWM) Core Library are responsible for producing all observable elements on a computer, such as themes, wallpapers, menus, and other visual elements. It goes by the name Desktop Compositing Engine (DCE) and has been a feature of Microsoft Windows since Windows Vista.

If the exploit is effective, the attacker might be able to obtain SYSTEM privileges.

This CVE has been added by CISA to its catalog of known exploited vulnerabilities, and users are asked to fix it by May 6, 2024.

CVE-2024-30044:

Using the web-based platform Microsoft SharePoint, businesses may build websites for information sharing, storing, organizing, and access. SharePoint is compatible with PCs, Macs, and mobile devices and is part of Microsoft 365.

To cause the deserialization of the file’s arguments, an authorized attacker with Site Owner access or above could upload a specially created file to the targeted SharePoint Server and create unique API queries. If the vulnerability is successfully exploited, an attacker might be able to execute code remotely while using the SharePoint Server.

Other Vulnerabilities:

• The Windows Common Log File System Driver contains two elevation of privilege vulnerabilities, CVE-2024-29996 and CVE-2024-30025. If the exploit is effective, the attacker might be able to obtain SYSTEM privileges.
• A security feature bypass vulnerability in Windows Mark of the Web is identified as CVE-2024-30050. To take advantage of this vulnerability, an attacker may host a file on a server and persuade a specific user to download and open the file. After successful exploitation, an attacker may modify the Mark of the Web’s functionality.
• An elevation of privilege vulnerability in the Windows DWM Core Library is identified as CVE-2024-30032. If the exploit is effective, the attacker might be able to obtain SYSTEM privileges.
• The Windows Cloud Files Mini Filter Driver has two information disclosure vulnerabilities: CVE-2024-30034 and CVE-2024-30035. If the attack is successful, the attacker could reveal specific contents of the kernel memory.
• A Win32k elevation of privilege vulnerability is identified as CVE-2024-30038. If the vulnerability is successfully exploited, a local, authenticated attacker might be able to escalate their privileges as an administrator or local system.
• An elevation of privilege vulnerability in the Windows Win32 Kernel Subsystem is identified as CVE-2024-30049. If the exploit is effective, the attacker might be able to obtain SYSTEM privileges.

List of CVEs in the patch Tuesday updates:

Recommendations

• Give the installation of all Microsoft software’s May 2024 Patch Tuesday upgrades top priority. To reduce vulnerabilities, particularly the two actively exploited zero-days, make sure both operating systems and applications are up to date.
• To fix the 30 vulnerabilities that have been fixed, including the two major zero-days, update your Edge browser to the most recent version. Edge is built on Chromium.
• Perform comprehensive system audits in order to find any indications that the vulnerabilities CVE-2024-30040 and CVE-2024-30051 are being exploited. Seek out signs of compromise and, should any questionable activity be discovered, take appropriate action.
• Pay attention to security advisories and notifications from CISA and other cybersecurity agencies, as well as Microsoft. Make sure you install any updates or patches that are made available in response to these vulnerabilities as soon as possible.
• The security policies for the organization should be reviewed and updated to include the steps for timely patch management and vulnerability mitigation. Make sure that these guidelines are routinely audited and properly adhered to.