Source: www.securityweek.com – Author: Ryan Naraine
Software giant Microsoft on Tuesday rolled out patches for more than 70 documented security defects and called urgent attention to an already-exploited zero-day in the Windows Common Log File System (CLFS).
The CLFS vulnerability, tagged as CVE-2024-49138 and marked as actively exploited in the wild, was reported by anti-malware vendor CrowdStrike. It carries a CVSS severity score of 7.8/10.
According to an important bulletin from Redmond, the CLFS driver flaw allows attackers to gain SYSTEM privileges through a heap-based buffer overflow. A successful exploit requires no user interaction and low privileges to execute, Microsoft warned.
As is customary, the company did not release indicators of compromise (IOCs) or any other telemetry to help defenders hunt for signs of compromise.
Over the last five years, there have been at least 25 documented vulnerabilities in CLFS, the Windows subsystem used for data and event logging. Earlier this year, Microsoft said it was experimenting with a major new security mitigation to thwart a surge in cyberattacks hitting flaws in the Windows CLFS.
The company plans to add Hash-based Message Authentication Codes (HMAC) to detect unauthorized modifications to CLFS log files and cover one of the most attractive attack surfaces for APTs and ransomware attacks.
The December Patch Tuesday also provides documentation for CVE-2023-44487, the infamous HTTP/2 Rapid Reset Attack that was exploited as zero-day in large-scale DoS campaigns. Microsoft said it originally shipped patches for this issue last October for all affected versions of .NET and Microsoft Visual Studio and is again pushing users to install available updates.
Microsoft also called immediate attention to at least 16 critical-severity issues in a wide range of Windows OS and components and urged sysadmins to prioritize a WIndows LDAP remote code execution bug that carries a CVSS severity score of 9.8/10.
Advertisement. Scroll to continue reading.
The Windows LDAP bug, tagged as CVE-2024-49112, is so serious that Microsoft is recommending disconnecting Domain Controllers from the internet as a temporary mitigation.
“An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through a specially crafted set of LDAP calls to execute arbitrary code within the context of the LDAP service,” the company said.
The December batch of patches also covers a major guest-to-host remote code execution flaw (CVE-2024-49117) in Windows Hyper-V, critical RCE bugs in Windows Remote Desktop Services, a pair of major defects in the Microsoft Message Queuing (MSMQ) service and a critical RCE in the Microsoft/Muzic AI research project.
According to data from ZDI, a company that tracks bug disclosures, Microsoft has shipped patches for 1,020 vulnerabilities in 2024 (counting by documented CVEs).
So far this year, there have been 27 documented zero-day attacks hitting computer users in the Microsoft Windows ecosystem.
Related: Microsoft Intros HMAC-Based Mitigation for Windows Logfile Flaws
Related: ‘HTTP/2 Rapid Reset’ Zero-Day Exploited in Massive DDoS Attacks
Related: Microsoft Patches Another Already-Exploited Windows Zero-Day
Related: Organizations Respond to HTTP/2 Zero-Day Exploited for DDoS Attacks
Related: Microsoft Patches Windows Zero-Day Exploited by Russian Hackers
Original Post URL: https://www.securityweek.com/microsoft-ships-urgent-patch-for-exploited-windows-clfs-zero-day/
Category & Tags: Malware & Threats,Vulnerabilities,CVE-2023-44487,CVE-2024-49112,CVE-2024-49138,Microsoft,Patch Tuesday – Malware & Threats,Vulnerabilities,CVE-2023-44487,CVE-2024-49112,CVE-2024-49138,Microsoft,Patch Tuesday
Views: 4
