November 2024 Patch Tuesday patches four zero days and three critical flaws – Source: www.csoonline.com

After hitting users with five zero-day vulnerabilities in October, November’s Patch Tuesday update has followed up with another four from a total haul of 89 CVEs.

In terms of priorities, admins will want to start by patching the two zero days that are being actively exploited before moving on to three other vulnerabilities rated “critical”, plus one with a CVSS rating of 9.9 that is rated “important”.

Exploited zero days

The first exploited zero day, CVE-2024-49039, allows an attacker to elevate their privileges from an AppContainer (a low-privileged security sandbox isolation around applications since Windows 8) thanks to a flaw in the Windows Task Scheduler. Rated with a CVSS score of 8.8, Microsoft offers little detail on the flaw beyond noting:

“To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application on the target system to exploit the vulnerability to elevate their privileges to a Medium Integrity Level.”

The second exploited zero day, CVE-2024-43451, earns a lower CVSS of 6.5 but will still be a worry, given that it’s a hash disclosure flaw in the now deprecated NTLMv2 affecting all versions of Windows stretching back to Windows Server 2008.

For a hacker, the most direct route past security is to defeat or bypass authentication in some way. That can be done by stealing passwords, but also by stealing their hashes. In the case of this flaw, that would allow an attacker to conduct a pass-the-hash attack by siphoning off the hash from memory before using it to authenticate on a target system.

NTLM is being ripped out in favor of Kerberos (see below for a separate flaw affecting it) but that doesn’t mean there won’t be organizations out there still using it to support legacy applications. Microsoft has recently struggled to contain a series of similar-looking flaws, including a prominent one in Windows Themes revealed in late September which allows an attacker to steal NTLM credentials.

Other zero days

The other two zero days being patched are CVE-2024-49040, a flaw in Exchange rated “important” that could allow an attacker to spoof the email address of a sender, and CVE-2024-49019, an elevation of privileges flaw in Active Directory (AD) which an attacker could use to gain the powers of a domain admin.

Critical and notable flaws

Also important are three critical flaws, CVE-2024-43625, CVE-2024-43498, and CVE-2024-43639, the latter two of which have CVSS scores of 9.8. The last of the three, CVE-2024-43639 is a remote code execution (RCE) vulnerability in Kerberos on which Microsoft offered little detail beyond the general description:

“An unauthenticated attacker could use a specially crafted application to leverage a cryptographic protocol vulnerability in Windows Kerberos to perform remote code execution against the target.”

Meanwhile, CVE-2024-43498 is an RCE in .NET and Visual Studio which, despite its “critical” status, Microsoft nevertheless rates as “less likely” to be exploited. As to CVE-2024-43625, a privilege escalation flaw in the VMSwitch functionality of Hyper-V, Microsoft said:

“In this case, a successful attack could be performed from a low privilege Hyper-V guest. The attacker could traverse the guest’s security boundary to execute code on the Hyper-V host execution environment.”

Anything that poses a security risk to Hyper-V will make admins sit up and take notice, although from Microsoft’s description, exploiting it would require an attacker to gather “information specific to the environment” and would therefore would not be easy to target. 

A fourth critical flaw, CVE-2024-49056, has already been mitigated by Microsoft and requires no action by users. This is a new categorization recently instituted by Microsoft to aid “greater transparency.”

Finally, there’s CVE-2024-43602, which gets the highest CVSS rating of November’s update, 9.9. This is an RCE in the Azure CycleCloud tool used in High Performance Computing (HPC) Azure clusters. Successful exploitation would allow an attacker to steal admin credentials, gaining root permissions, Microsoft said.