Today's cybersecurity headlines are brought to you by ThreatPerspective
Ethical Hacking News

Micorosft Issues 117 Patches, Including Two Under Active Attack


Microsoft has released its monthly patch cycle, dubbed Patch Tuesday, which includes a staggering 117 patches for various vulnerabilities and flaws across multiple software platforms. Stay ahead of the curve by understanding the latest Windows patches and SAP security vulnerabilities.

  • Microsoft has released its monthly patch cycle, dubbed Patch Tuesday, with a total of 117 patches to address various vulnerabilities.
  • A remote code execution flaw (CVE-2024-43572) is being actively exploited by malicious actors, which could have severe consequences if successful.
  • Another patch deals with CVE-2024-43573 – a CVSS 6.5 spoofing flaw in MSHTML affecting all versions of Windows Server after 2012 R2 and many releases of Windows 10.
  • Microsfot has addressed other vulnerabilities including a CVSS 8.8 flaw in curl (CVE-2024-6197) and a 9.0 elevation of privilege flaw in Netlogon (CVE-2024-38124).
  • SAP has reported a dozen issues, six of which are patches for previous patches.



    • Microsoft has released its monthly patch cycle, dubbed Patch Tuesday, which includes a staggering 117 patches for various vulnerabilities and flaws across multiple software platforms. The most serious of these patches are two that have already been under active attack by malicious actors. This highlights the importance of staying up-to-date with security patches to prevent exploitation.

    Among the patches released by Microsoft, there is a 7.8-rated problem with Microsoft's Management Console (MSC) that would allow an unauthorized local attacker to run code on a machine using untrusted Microsoft Saved Console (MSC) files. The most serious flaw already being exploited by malfeasants is CVE-2024-43572 – a remote code execution flaw, which could have nasty consequences if successfully exploited.

    The flaw in question affects Windows Server 2008 through 2022, as well as versions of Windows 10 and 11. In order to take advantage of this vulnerability, an attacker would need to convince a victim to install the malicious file locally. Microsoft rates this as a remote code execution flaw, suggesting that even if the attack is successful, it will be difficult for an attacker to gain access to the machine.

    Another patch released by Microsoft deals with CVE-2024-43573 – a CVSS 6.5 spoofing flaw in MSHTML that could be described as moderate risk. This issue affects all versions of Windows Server after 2012 R2, as well as many releases of Windows 10.

    In addition to these serious patches, there are several other vulnerabilities that have been addressed by Microsoft. These include a CVSS 8.8 flaw in curl (CVE-2024-6197) that could be used to infect someone who connected to the wrong server, and a 9.0 elevation of privilege flaw in Netlogon (CVE-2024-38124). There is also a 9.8 remote code execution vulnerability in Microsoft Configuration Manager that would allow remote code execution via SQL.

    Furthermore, SAP has reported a dozen issues – six of which are patches for previous patches. The worst of the re-patches covers CVE-2024-41730, a 9.8-rated BusinessObjects bug the ERP giant tried to patch back in August but which needs another fix.

    The most recent information comes from Microsoft's Patch Tuesday release on October 2nd, 2024, which includes several notable patches for various vulnerabilities and flaws across multiple software platforms.



    Related Information:

  • https://go.theregister.com/feed/www.theregister.com/2024/10/08/patch_tuesday_october_2024/

  • https://www.msn.com/en-us/news/technology/microsoft-issues-117-patches-some-for-flaws-already-under-attack/ar-AA1rV4Dw

  • https://thehackernews.com/2021/07/update-your-windows-pcs-to-patch-117.html

  • https://nvd.nist.gov/vuln/detail/CVE-2024-43572

  • https://www.cvedetails.com/cve/CVE-2024-43572/

  • https://nvd.nist.gov/vuln/detail/CVE-2024-43573

  • https://www.cvedetails.com/cve/CVE-2024-43573/

  • https://nvd.nist.gov/vuln/detail/CVE-2024-6197

  • https://www.cvedetails.com/cve/CVE-2024-6197/

  • https://nvd.nist.gov/vuln/detail/CVE-2024-38124

  • https://www.cvedetails.com/cve/CVE-2024-38124/

  • https://nvd.nist.gov/vuln/detail/CVE-2024-41730

  • https://www.cvedetails.com/cve/CVE-2024-41730/


    • Published: Tue Oct 8 18:59:30 2024 by llama3.2 3B Q4_K_M


         


    © Ethical Hacking News . All rights reserved.

    Privacy | Terms of Use | Contact Us