Microsoft Patch Tuesday November 2024: Fixes 91 vulnerabilities

Yesterday, Microsoft released Patch Tuesday November 2024, which fixes 91 vulnerabilities, including four zero-days.

Four of the vulnerabilities have been categorized as critical: two allow remote code execution and two allow elevation of privilege.

In the list below you can see in detail the types of vulnerabilities fixed in Microsoft Patch Tuesday November:

• 52 vulnerabilities that allow remote code execution
• 26 vulnerabilities that allow for elevation of privilege
• 4 vulnerabilities that allow Denial of Service attacks
• 3 vulnerabilities that allow spoofing
• 2 vulnerabilities that allow bypassing security
• 1 vulnerability that allows information disclosure

Also included are 2 Edge bugs that were previously fixed (on November 7th).

See also: HPE patches vulnerabilities in Aruba Networking Access Points

Microsoft Patch Tuesday November 2024: Four zero-days fixed

This month's Patch Tuesday fixes vulnerabilities zero-day: two actively exploited in attacks and two publicly disclosed.

Let's look at them in more detail:

CVE-2024-43451 – NTLM Hash Disclosure Spoofing Vulnerability

Microsoft has patched a vulnerability that exposes NTLM hashes to remote attackers, with minimal interaction with a malicious file.

An attacker could use NTLMv2 hash to authenticate as a user.

"Minimal interaction with a malicious file by a user, such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing, could trigger this vulnerability," Microsoft continued.

Microsoft says that Israel Yeshurun ​​of ClearSky Cyber ​​Security discovered this vulnerability but did not provide details on its exploitation.

See also: CISA: Added Palo Alto Networks vulnerability to the KEV List

CVE-2024-49039 – Windows Task Scheduler Elevation of Privilege Vulnerability

This is a vulnerability that could allow elevation of privilege.

“In this case, a successful attack could be carried out from a low-privilege AppContainer. The attacker could escalate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment,” Microsoft explained.

Microsoft says that exploiting this vulnerability would allow attackers to perform RPC operations, which are typically restricted to privileged accounts.

The flaw was discovered by Vlad Stolyarov and Bahare Sabouri of Google's Threat Analysis Team.

It is not known how it was used in the attacks.

CVE-2024-49040 – Microsoft Exchange Server Spoofing Vulnerability

With Microsoft's November Patch Tuesday, the company is patching a Microsoft Exchange vulnerability that allows threat actors to spoof the sender's email address in emails to local recipients.

“The vulnerability is caused by the current implementation of P2 FROM header verification“.

Starting with this month's Microsoft Exchange security updates, Microsoft now detects and flags phishing emails with a notification attached to the body of the message: "Note: This email appears to be suspicious. Do not trust information, links, or attachments in this email without verifying the source through a trusted method."

See also: Google warns of Android vulnerability exploitation

Microsoft says the vulnerability was discovered by Slonser of Solidlab.

CVE-2024-49019 – Active Directory Certificate Services Elevation of Privilege Vulnerability

Microsoft has fixed a vulnerability that could allow attackers to gain domain administrator privilegesby abusing the built-in default version 1 certificate templates.

The flaw was discovered by Lou Scicchitano, Scot Berner, and Justin Bollinger of TrustedSec.

Microsoft Patch Tuesday November 2024: All vulnerabilities fixed

Microsoft Patch Tuesday is a practice followed by Microsoft, where on the second Tuesday of each month it releases updates and fixes for its operating systems, programs, and applications. These updates typically include security, performance improvements, and new features.

The purpose of Microsoft Patch Tuesday is to provide Microsoft users with the best possible user experience by fixing issues and ensuring the security of their systems. Security updates help protect systems from security vulnerabilities and malware. These updates fix known security issues and strengthen the resilience of systems against attacks.

Source: www.bleepingcomputer.com