Breaking Down the Latest October 2024 Patch Tuesday Report

Microsoft has released its October 2024 Patch Tuesday updates, addressing 118 vulnerabilities across Windows, Office, Dynamics, Azure, and other products. This release includes fixes for five zero-day vulnerabilities, with two actively exploited in the wild, along with three critical remote code execution flaws.

Out of the total vulnerabilities patched this month, 3 are rated Critical and 114 are rated Important, with 1 rated Moderate. The most common vulnerability types in this release are:

Among the highlights are two actively exploited zero-days: a Windows MSHTML Platform spoofing vulnerability (CVE-2024-43573) and a Microsoft Management Console remote code execution vulnerability (CVE-2024-43572). Additionally, three other zero-days were publicly disclosed but not exploited: a curl remote code execution vulnerability (CVE-2024-6197), a Windows Hyper-V security feature bypass (CVE-2024-20659), and a Winlogon elevation of privilege vulnerability (CVE-2024-43583).

Key products receiving security updates include Windows, Office, Exchange Server, Azure, Dynamics, .NET Framework, Windows Hyper-V, and Microsoft Edge. Administrators should prioritize testing and deploying patches for the actively exploited zero-days and remote code execution flaws.

This month's Patch Tuesday also addresses critical vulnerabilities in Microsoft Configuration Manager (CVE-2024-43468), Visual Studio Code extension for Arduino (CVE-2024-43488), and Remote Desktop Protocol Server (CVE-2024-43582). Each of these flaws could allow remote code execution under specific conditions.

Let's break down what is there in the October patches that Microsoft released on October 8th.

Key Highlights - Patch Tuesday October 2024

In October's Patch Tuesday, Microsoft addressed 118 vulnerabilities, including five zero-day vulnerabilities, with two being actively exploited in the wild. This update included patches across categories like remote code execution, elevation of privilege, denial of service, security feature bypass, information disclosure, and spoofing vulnerabilities.

The key affected products in this update span across Microsoft's ecosystem, including Windows, Office, Exchange Server, Azure, Dynamics 365, .NET Framework, Windows Hyper-V, and Microsoft Edge. Administrators and end users are advised to apply these security updates promptly to protect their systems from these vulnerabilities.

Key Highlights are:

3. Vulnerability Types: The vulnerabilities addressed include:

4. Zero-Day Threats: The five zero-day vulnerabilities include:

* CVE-2024-43573: Windows MSHTML Platform Spoofing vulnerability

* CVE-2024-43572: Microsoft Management Console Remote Code Execution vulnerability

* CVE-2024-6197: Open Source Curl Remote Code Execution vulnerability

* CVE-2024-20659: Windows Hyper-V Security Feature Bypass vulnerability

* CVE-2024-43583: Winlogon Elevation of Privilege vulnerability

5. Notable Issues: Other major issues include multiple remote code execution vulnerabilities in Windows Routing and Remote Access Service (RRAS), Remote Desktop Client, and privilege escalation flaws across various Windows components.

Zero-day Vulnerabilities Patched in October 2024

Microsoft addressed five zero-day vulnerabilities in the October 2024 Patch Tuesday release. Two of these vulnerabilities were being actively exploited in the wild prior to the patches being made available. Let's examine each of these critical vulnerabilities:

CVE-2024-43573 - Windows MSHTML Platform Spoofing Vulnerability

This vulnerability in the Windows MSHTML platform was being actively exploited in the wild. While Microsoft has not shared detailed information about the exploitation, they noted that it involves the MSHTML platform, previously used by Internet Explorer and Legacy Microsoft Edge, whose components are still installed in Windows.

"While Microsoft has announced retirement of the Internet Explorer 11 application on certain platforms and the Microsoft Edge Legacy application is deprecated, the underlying MSHTML, EdgeHTML, and scripting platforms are still supported," explained Microsoft.

This is the fourth zero-day vulnerability in the Windows MSHTML Platform that was exploited in the wild in 2024. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog and urges users to patch before October 29, 2024.

CVE-2024-43572 - Microsoft Management Console Remote Code Execution Vulnerability

This remote code execution vulnerability in Microsoft Management Console (MMC) was also actively exploited in the wild. The vulnerability allows malicious Microsoft Saved Console (MSC) files to perform remote code execution on vulnerable devices.

Microsoft fixed the flaw by preventing untrusted MSC files from being opened: "The security update will prevent untrusted Microsoft Saved Console (MSC) files from being opened to protect customers against the risks associated with this vulnerability."

CVE-2024-6197 - Open Source Curl Remote Code Execution Vulnerability

This vulnerability affects the curl command line tool bundled with Windows. While the upstream advisory applies to both curl and libcurl, Windows only ships the curl command line tool. Successful exploitation requires a client to connect to a malicious server, which could allow the attacker to gain code execution on the client.

CVE-2024-20659 - Windows Hyper-V Security Feature Bypass Vulnerability

This security feature bypass vulnerability in Windows Hyper-V could allow attackers to compromise the hypervisor and kernel. The vulnerability relates to Virtual Machines within a Unified Extensible Firmware Interface (UEFI) host machine. On specific hardware configurations, it might be possible to bypass the UEFI, leading to compromise of the hypervisor and secure kernel.

Microsoft notes that an attacker needs physical access to the device and must reboot it to exploit the flaw. The vulnerability was publicly disclosed but not observed being exploited in the wild.

CVE-2024-43583 - Winlogon Elevation of Privilege Vulnerability

This elevation of privilege vulnerability in Winlogon could allow attackers to gain SYSTEM privileges. To address this vulnerability, Microsoft recommends ensuring that a Microsoft first-party IME is enabled on the device. This helps protect devices from potential vulnerabilities associated with third-party IMEs during the sign-in process.

Critical Vulnerabilities Patched in October 2024

Microsoft addressed three critical vulnerabilities in the October 2024 Patch Tuesday release. Let's take a closer look at these critical vulnerabilities:

CVE-2024-43468 - Microsoft Configuration Manager Remote Code Execution Vulnerability

CVE-2024-43468 is a critical remote code execution vulnerability in Microsoft Configuration Manager, earning the highest CVSS score of 9.8 in this month's release. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment, which are processed unsafely. Successful exploitation could allow the attacker to:

Microsoft has advised that administrators must install an in-console update as the primary mitigation path. For those unable to immediately implement updates, Microsoft suggests using an alternate service account for the Management point connection account instead of the default "Computer" account as a temporary workaround.

CVE-2024-43582 - Remote Desktop Protocol Server Remote Code Execution Vulnerability

This critical vulnerability in the Remote Desktop Protocol Server received a CVSS score of 8.1. The vulnerability could allow remote code execution under the following conditions:

CVE-2024-43488 - Visual Studio Code extension for Arduino Remote Code Execution Vulnerability

The third critical vulnerability affects the Visual Studio Code extension for Arduino, with a CVSS score of 8.8. The vulnerability stems from missing authentication for critical functions in the extension. Key characteristics include:

Vulnerabilities by Category

In total, 118 vulnerabilities were addressed in October's Patch Tuesday, with remote code execution being the most common vulnerability type patched by Microsoft this month, occurring 43 times. Elevation of privilege bugs also accounted for a significant portion of the flaws fixed with 28 occurrences. The least common vulnerability category was information disclosure, with 6 such flaws patched in October.

Here is the breakdown of the categories patched this month:

Here is a table with the vulnerability categories and associated CVE IDs from Microsoft's October 2024 Patch Tuesday:

List of Products Patched in October 2024 Patch Tuesday Report

Microsoft's October 2024 Patch Tuesday includes updates for a broad range of its products, applications, and services. Here are the applications and product components that have received patches:

Complete List of Vulnerabilities Patched in October 2024 Patch Tuesday.

Download the complete list of vulnerabilities by products patched in October 2024 Patch Tuesday here. 

Apps vulnerabilities

Azure vulnerabilities

Browser vulnerabilities

Developer Tools vulnerabilities

ESU Windows vulnerabilities

Mariner Windows vulnerabilities

Microsoft Office vulnerabilities

SQL Server vulnerabilities

System Center vulnerabilities

Windows vulnerabilities

Bottom Line

Microsoft's October 2024 Patch Tuesday addressed 118 vulnerabilities, including five zero-day vulnerabilities, with two actively exploited in the wild. This release fixed a variety of vulnerability types, with remote code execution issues being most prevalent at 43 instances, followed by the elevation of privilege vulnerabilities at 28 instances.

Among the critical updates were:

* Windows MSHTML Platform spoofing vulnerability (CVE-2024-43573)

* Microsoft Management Console remote code execution vulnerability (CVE-2024-43572)

This month's release highlights Microsoft's continued commitment to addressing security vulnerabilities across its product portfolio. The significant number of remote code execution and elevation of privilege vulnerabilities, along with the presence of actively exploited zero-days, emphasizes the importance of prompt patching and regular system maintenance.

Highlighting the breadth of this update:

Organizations should prioritize the deployment of these security updates, particularly for systems affected by zero-day vulnerabilities and critical remote code execution flaws.

We aim to keep readers informed each month in our Patch Tuesday reports. Please follow our website thesecmaster.com or subscribe to our social media pages on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram to receive similar updates.

You may also like these articles: