Skip to main content

Scheduled updates for Microsoft products, including security updates for 50 vulnerabilities

Threat ID:CC-4510
Threat Severity:Medium
Published:12 June 2024 3:49 PM

Summary

Scheduled updates for Microsoft products, including security updates for 50 vulnerabilities

Affected platforms

The following platforms are known to be affected:

Microsoft Windows
Microsoft Outlook

The following platforms are also known to be affected:

  • Azure Data Science Virtual Machines
  • Azure File Sync
  • Azure Monitor
  • Azure SDK
  • Azure Storage Library
  • Dynamics Business Central
  • Microsoft Dynamics
  • Microsoft Office
  • Microsoft Office SharePoint
  • Microsoft Office Word
  • Microsoft Streaming Service
  • Microsoft WDAC OLE DB provider for SQL
  • Microsoft Windows Speech
  • Visual Studio
  • Windows Cloud Files Mini Filter Driver
  • Windows Container Manager Service
  • Windows Cryptographic Services
  • Windows DHCP Server
  • Windows Distributed File System (DFS)
  • Windows Event Logging Service
  • Windows Kernel
  • Windows Kernel-Mode Drivers
  • Windows Link Layer Topology Discovery Protocol
  • Windows NT OS Kernel
  • Windows Perception Service
  • Windows Remote Access Connection Manager
  • Windows Routing and Remote Access Service (RRAS)
  • Windows Server Service
  • Windows Standards-Based Storage Management Service
  • Windows Storage
  • Windows Themes
  • Windows Wi-Fi Driver
  • Windows Win32 Kernel Subsystem
  • Windows Win32K - GRFX
  • Winlogon

Threat details

Proof-of-concept for CVE-2023-50868 and CVE-2024-30088

Proof-of-concept exploit code for CVE-2023-50868 and CVE-2023-30088 has been publicly released. Exploitation is considered more likely.


Introduction

Microsoft has released security updates to address 50 vulnerabilities, including one rated as critical and one older vulnerability that has now been patched. 


CVE-2024-30078 Exploitable Without User Interaction

CVE-2024-30078, an improper input validation vulnerability in Windows Wi-Fi Driver, could allow an attacker to achieve remote code execution without authentication or interaction. Microsoft have recommended that this affected organisations patch this vulnerability as a matter of priority.


Vulnerability details

  • CVE-2024-30068 is an out-of-bounds read vulnerability in the Windows kernel with a CVSSv3 score of 8.8, which if exploited could lead to privilege escalation to gain SYSTEM privileges. 
  • CVE-2024-30097 is a double free vulnerability in the Microsoft Speech Application Programming Interface (SAPI) with a CVSSv3 score of 8.8, which if exploited could lead to remote code execution (RCE).
  • CVE-2024-30080 is a use-after-free vulnerability in Microsoft Message Queuing (MSMQ) with a CVSSv3 score of 9.8, which if exploited could lead to RCE on the MSMQ server.
  • CVE-2024-30103 is an incomplete list of disallowed inputs vulnerability in Microsoft Outlook with a CVSSv3 score of 8.8, which if exploited could lead to RCE via the creation of malicious DLL files.
  • CVE-2024-30068 is an improper input validation vulnerability in Windows Wi-Fi Driver with a CVSSv3 score of 8.8.
  • CVE-2023-50868 is a denial-of-service (DOS) vulnerability within the DNSSEC protocol (also known as NSEC3 issue) with a CVSSv3 score of 7.5
  • CVE-2024-30088 is a privilege escalation vulnerability with a CVSSv3 score of 7.0, which an attacker could exploit to gain SYSTEM privileges.

Threat updates

  
24 Sep 2024Proof-of-concept exploit code has been published for CVE-2024-30088
17 Jun 2024CVE-2024-30078 Exploitable Without User Interaction

The cyber alert has been updated to reflect this change

Remediation advice

Affected organisations are encouraged to review Microsoft’s June 2024 Security Update Summary and apply the relevant updates.

Definitive source of threat updates

CVE Vulnerabilities

StatusPublished
CVE-2024-30078Windows Wi-Fi Driver Remote Code Execution Vulnerability
StatusPublished
CVE-2023-50868The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
StatusPublished
CVE-2024-30068Windows Kernel Elevation of Privilege Vulnerability
StatusPublished
CVE-2024-30097Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
StatusPublished
CVE-2024-30080Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
StatusPublished
CVE-2024-30103Microsoft Outlook Remote Code Execution Vulnerability
StatusPublished
CVE-2024-30088Windows Kernel Elevation of Privilege Vulnerability

Last edited: 24 September 2024 2:12 pm

Back to top