Breaking Down the Latest January 2024 Patch Tuesday Report

Microsoft has kicked off 2024 by disclosing fixes for 49 vulnerabilities in its January Patch Tuesday security updates. Impacting Windows, Office, Dynamics, Azure, and other products, this release addresses concerns rated as Critical for two flaws while giving an Important ranking to 47 bugs.

The two Critical flaws are a Windows Kerberos authentication bypass and a Windows Hyper-V remote code execution vulnerability. The Important fixes cover elevation of privilege, remote code execution, spoofing, denial of service, security feature bypass, and information disclosure vulnerabilities.

Among the highlights are remote code execution vulnerabilities in Office related to FBX 3D model files, SharePoint server, ODBC driver, and other components. There is also a critical Kerberos authentication bypass that could enable spoofing attacks.

Additional key fixes address privilege escalation in Windows Subsystem for Linux and the kernel, information disclosure in LSASS and TCP/IP, spoofing in Windows Themes and Nearby Sharing, denial of service in Microsoft Async, and security feature bypasses in .NET/Visual Studio and BitLocker.

In this monthly report, we have provided an analysis of severity ratings, exploitation vectors, and remediation advice to help prioritize patching. Whether you manage Windows clients and servers or cloud-based services, applying these latest critical and important updates helps secure environments as 2024 begins.

Key Highlights – Patch Tuesday January 2024

In January’s Patch Tuesday, Microsoft addressed 49 flaws, including two critical vulnerabilities: a Windows Kerberos authentication bypass and a Windows Hyper-V remote code execution. This update included patches across categories like elevation of privilege, remote code execution, spoofing, denial of service, security feature bypass, and information disclosure.

Key highlights are:

This January Patch Tuesday kicks off 2024 by addressing vulnerabilities across Microsoft’s ecosystem. Apply these updates to close vulnerabilities before threats exploit them.

Critical Vulnerabilities Patched in January 2024

A Windows Kerberos authentication bypass (CVE-2024-20674) and a Windows Hyper-V remote code execution bug (CVE-2024-20700) lead to this month’s high severity threats. Let’s take a closer look at these two critical vulnerabilities.

CVE-2024-20674- Windows Kerberos Bug Allows Authentication Bypass

CVE-2024-20674 scores a 9.1 CVSS rating for its threat to bypass Windows Kerberos authentication via spoofing. By establishing a machine-in-the-middle attack on the network, an unauthenticated attacker could impersonate a Kerberos server and trick a client into thinking it is communicating directly with the real authentication server.

While exploiting this requires network access, its high potential impact and expected public exploit code make it a priority patch. Successful exploitation could completely bypass Kerberos authentication checks.

CVE-2024-20700 – Hyper-V Remote Code Execution Permits System Takeover

The Windows Hyper-V remote code execution vulnerability CVE-2024-20700 earns a 7.5 CVSS score but allows executing arbitrary code on the host from the guest system. While specifics are light, Microsoft notes no authentication or user interaction is necessary, making this bug perfect for exploit chains.

Since Hyper-V often runs with elevated privileges, this RCE could lead to full system compromise. Fixes are vital for securing hypervisor deployments against intrusion and subsequent lateral movement attempts.

Other Important Vulnerabilities Patched in January 2024

While the Windows Kerberos and Hyper-V bugs rank as the two critical issues fixed this month, Microsoft tackled many other important vulnerabilities that require prioritized patching as well.

A remote code execution flaw in the Microsoft Office suite allows arbitrary code execution by embedding malicious FBX 3D model files in Office documents. With no user interaction needed in some cases, this attack vector posed considerable risks.

Additional RCE bugs hit the SharePoint server, ODBC driver, Remote Desktop Client, OCSP, and other components. Most require some level of authentication or interaction, lessening the threats. Still, applying fixes prevents exploit chains from utilizing these important bugs as initial access vectors.

On the privilege escalation front, bugs could boost access levels for the Windows kernel, Subsystem for Linux, Cloud Files, and printing components. The 10 total elevation of privilege flaws provide ripe targets for chaining following an intrusion to gain deeper system control.

While less likely to serve as initial compromise vectors, important information disclosure vulnerabilities in LSASS, TCP/IP, cryptographic services, and messaging queuing merit remediation as well. Attackers often leverage data leaks to mount more focused, severe assaults.

In total, a wide range of products receive important-level security fixes in this first Patch Tuesday of 2024. But focusing on the remote code execution and privilege escalation weaknesses likely poses the most pressing threats.

Vulnerabilities by Category

In total, 49 vulnerabilities were addressed in January’s Patch Tuesday. Remote Code Execution flaws top the list with 12 patches, followed by 11 Information Disclosure and 10 Elevation of Privilege vulnerabilities. The rest consist of 7 Security Feature Bypass, 6 Denial of Service, and 3 Spoofing flaws.

Here is the breakdown of the categories patched this month:

The table below shows the CVE IDs mapped to these vulnerability types from Microsoft’s January 2024 Patch Tuesday:

List of Products Patched in January 2024 Patch Tuesday

Microsoft’s January 2024 Patch Tuesday includes updates for a wide range of its products, applications, and services. Here are the key products and components that received patches:

Complete List of Vulnerabilities Patched in January 2024 Patch Tuesday

Download the complete list of vulnerabilities by products patched in January 2024 Patch Tuesday here. 

Azure vulnerabilities

Browser vulnerabilities

Developer Tools vulnerabilities

Developer Tools Azure vulnerabilities

Developer Tools SQL Server vulnerabilities

ESU Windows vulnerabilities

Microsoft Office vulnerabilities

Windows vulnerabilities

Windows Mariner vulnerabilities

Bottom Line

Microsoft’s January 2024 Patch Tuesday addressed 49 vulnerabilities, including two critical remote code execution flaws impacting Windows Kerberos and Hyper-V.

This release fixed a variety of vulnerability types, with elevation of privilege issues being most prevalent at 10 instances. Remote code execution ranked second with 12 patches issued. The two critical bugs consist of an authentication bypass in Kerberos permitting spoofing attacks and an RCE in Hyper-V allowing potential system takeovers.

Among the notable important-rated vulnerabilities are remote code executions impacting Microsoft Office, SharePoint Server, ODBC driver and other components. Multiple privilege escalation and information disclosure flaws also got addressed across Windows, Azure and Dynamics products.

In total, 49 security gaps were closed in this year’s first patch release. Prioritizing the Windows Kerberos and Hyper-V critical issues can help mitigate intrusion risks before threats exploit them in corporate environments.

We aim to keep readers informed each month in our Patch Tuesday reports. Please follow our website thesecmaster.com or subscribe to our social media pages on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram to receive similar updates.