February’s Patch Tuesday treats customers to 72 patches

Credit to Author: Angela Gunn| Date: Wed, 14 Feb 2024 09:23:10 +0000

After a light start to the year, February delivered 72 patches and 21 advisories to Microsoft customers. The CVEs addressed in this month’s Patch Tuesday release included 43 for Windows. Twelve other product groups or tools are also affected. Of the CVEs addressed, five are considered Critical in severity by Microsoft; these affect Windows, Office, Exchange, and Dynamics 365.

At patch time, two of the issues are known to be under exploit in the wild, and none has been publicly disclosed. (However, one of the advisory items most certainly has; more on that in a minute.) Eight of the addressed vulnerabilities in Windows, Office, and Exchange (including a Critical-severity elevation-of-privilege issue with an attention-getting 9.8 CVSS base score) are by the company’s estimation more likely to be exploited in the next 30 days. Six of the issues addressed are covered by Sophos protections, and we include information on those in a table below.

In addition to these patches the release included information on six Chromium/Edge-related CVEs, including an RCE that could lead to sandbox escapes; one MITRE-issued CVE concerning a DNS issue that could lead to denial of service; one Github-issued CVE addressing the recent CVE-2024-21626 “Leaky Vessel” issue affecting Mariner, disclosed in a lengthy public post by Snyk two weeks ago and patched by various other affected companies since then; and 13 Adobe advisories, all related to Acrobat Reader.

We don’t include advisories in the CVE counts and graphics below, but we provide information on everything in an appendix at the end of the article. We are as usual including at the end of this post three other appendices listing all Microsoft’s patches, sorted by severity, by predicted exploitability, and by product family.

  • Total Microsoft CVEs: 72
  • Total Adobe advisories covered in update: 13
  • Total Edge / Chromium issues covered in update: 6
  • Total Mariner advisories covered in update: 1
  • Total MITRE advisories covered in update: 1
  • Publicly disclosed: 0
  • Exploited: 2
  • Severity
    • Critical: 5
    • Important: 65
    • Moderate: 2
  • Impact
    • Remote Code Execution: 30
    • Elevation of Privilege: 16
    • Spoofing: 10
    • Denial of Service: 8
    • Information Disclosure: 5
    • Security Feature Bypass: 3

A bar chart showing the severity of the issues addressed in the February 2024 Microsoft patch release, sorted by impact; data is reproduced in the text of the article.

Figure 1: After January’s big month for information disclosure bugs, a wealth of OLE-related fixes put remote code execution back on top for February

Products

  • Windows: 43
  • Azure: 8
  • Dynamics 365: 8
  • Office: 5
  • .NET: 1
  • ASP.NET: 1 (shared with Visual Studio)
  • Defender: 1
  • Entra [Azure AD]: 1
  • Exchange: 1
  • Outlook 365: 1
  • Skype: 1
  • Teams for Android: 1
  • Visual Studio: 1 (shared with ASP.NET)

A bar chart showing the distribution of product families among the patches by Microsoft for February 2024; material is reiterated in the article.

Figure 2: It’s a Windows-heavy month, thanks in part to a large number of fixes for Windows Defender Application Control (WDAC)

Notable February updates

In addition to the issues discussed above, a few specific items are worth noting.

CVE-2024-21350, CVE-2024-21352, CVE-2024-21358, CVE-2024-21359, CVE-2024-21360, CVE-2024-21361, CVE-2024-21365, CVE-2024-21366, CVE-2024-21367, CVE-2024-21368, CVE-2024-21369, CVE-2024-21370, CVE-2024-21375, CVE-2024-21391 (15 CVEs)

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Fifteen CVEs that share not only a name but a severity (Important), an impact (RCE), a lofty CVSS base score (8.8), and a finder non-identification (Microsoft credits all 15 to “Anonymous”). They’re accompanied by one additional (but related?) patch that shares everything but the number and name – CVE-2024-21353, Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability.

CVE-2024-21404
Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability

This extra-spicy EoP – Microsoft assigns it only an Important severity rating, but its base CVSS is a critical-level 9.8 – targets the Azure AD Jira SSO plugin. Significantly, it doesn’t even require the attacker to authenticate to cause trouble; all it takes is a script to access a targeted Jira server, and the attacker will be able to update Entra ID SAML metadata and information for the plugin – allowing them to change the authentication of the application as they wish. The fix is an update to version 1.1.2; it’s available from either the Microsoft Download Center or from the Atlassian Marketplace.

CVE-2024-21410
Microsoft Exchange Server Elevation of Privilege Vulnerability

The other CVE with a 9.8 CVSS this month is a NTLM relay (pass-the-hash) vulnerability. It could allow the attacker to relay a user’s leaked Net-NTLMv2 hash against a vulnerable Exchange Server and authenticate as the user. It affects a hodge-podge of versions: Exchange Server 2016, cumulative update 23; Exchange Server 2019, cumulative update 13; and Exchange Server 2019, cumulative update 14. More information is available on Microsoft’s Exchange Team Blog, but know that the company believes this one is more likely to be exploited within the next 30 days.

CVE-2024-21378
Microsoft Outlook Remote Code Execution Vulnerability

Preview Pane is an attack vector for this important-severity RCE, and Microsoft believes that exploitation is more likely in the next 30 days. The race is on.

CVE-2024-21374
Microsoft Teams for Android Information Disclosure

The patch for this important-severity information disclosure issue is available via Google Play.

A bar chart showing cumulative patch counts for 2024 by impact and severity; in descending order of frequency, RCE, EoP, information disclosure, DoS, spoofing, security feature bypass.

Figure 3: 2024’s off and trotting – though, with just 120 patches so far, totals are running substantially behind other years. (The first two months of 2023 brought 173 patches; 2022, 154; 2021, 139; and 2020, 150.)

Sophos protections

 

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Windows Update Catalog website. Run the winver.exe tool to determine which build of Windows 10 or 11 you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of February patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE.

Remote Code Execution (30 CVEs)

Critical severity
CVE-2024-21357Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2024-21413Microsoft Office Remote Code Execution Vulnerability
Important severity
CVE-2024-20667Azure DevOps Server Remote Code Execution Vulnerability
CVE-2024-20673Microsoft Office Remote Code Execution Vulnerability
CVE-2024-21339Windows USB Generic Parent Driver Remote Code Execution Vulnerability
CVE-2024-21341Windows Kernel Remote Code Execution Vulnerability
CVE-2024-21347Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21349Microsoft ActiveX Data Objects Remote Code Execution Vulnerability
CVE-2024-21350Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21352Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21353Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21358Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21359Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21360Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21361Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21363Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-21365Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21366Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21367Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21368Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21369Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21370Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21372Windows OLE Remote Code Execution Vulnerability
CVE-2024-21375Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21376Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
CVE-2024-21378Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-21379Microsoft Word Remote Code Execution Vulnerability
CVE-2024-21384Microsoft Office OneNote Remote Code Execution Vulnerability
CVE-2024-21391Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21420Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

 

Elevation of Privilege (16 CVEs)

Critical severity
CVE-2024-21410Microsoft Exchange Server Elevation of Privilege Vulnerability
Important severity
CVE-2024-21304Trusted Compute Base Elevation of Privilege Vulnerability
CVE-2024-21315Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
CVE-2024-21329Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-21338Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21345Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21346Win32k Elevation of Privilege Vulnerability
CVE-2024-21354Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21355Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21371Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21397Microsoft Azure File Sync Elevation of Privilege Vulnerability
CVE-2024-21401Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
CVE-2024-21402Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2024-21403Microsoft Azure Kubernetes Services Confidential Container Elevation of Privilege Vulnerability
CVE-2024-21405Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Moderate severity
CVE-2024-21364Microsoft Azure Site Recovery Elevation of Privilege Vulnerability

 

Spoofing (10 CVEs)

Important severity
CVE-2024-20679Azure Stack Hub Spoofing Vulnerability
CVE-2024-21327Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVE-2024-21328Dynamics 365 Sales Spoofing Vulnerability
CVE-2024-21381Microsoft Azure Active Directory B2C Spoofing Vulnerability
CVE-2024-21389Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21393Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21394Dynamics 365 Field Service Spoofing Vulnerability
CVE-2024-21395Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21396Dynamics 365 Sales Spoofing Vulnerability
CVE-2024-21406Windows Print Spooler Spoofing Vulnerability

 

Denial of Service (8 CVEs)

Critical severity
CVE-2024-20684Windows Hyper-V Denial of Service Vulnerability
Important severity
CVE-2024-21342Windows DNS Client Denial of Service Vulnerability
CVE-2024-21343Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-21344Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-21348Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2024-21356Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
CVE-2024-21386.NET Denial of Service Vulnerability
CVE-2024-21404.NET Denial of Service Vulnerability

 

Information Disclosure (5 CVEs)

Critical severity
CVE-2024-21380Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
Important severity
CVE-2024-20695Skype for Business Information Disclosure Vulnerability
CVE-2024-21340Windows Kernel Information Disclosure Vulnerability
CVE-2024-21374Microsoft Teams for Android Information Disclosure Vulnerability
CVE-2024-21377Windows DNS Information Disclosure Vulnerability

 

Security Feature Bypass (3 CVEs)

Important severity
CVE-2024-21362Windows Kernel Security Feature Bypass Vulnerability
CVE-2024-21412Internet Shortcut Files Security Feature Bypass Vulnerability
Moderate Severity
CVE-2024-21351Windows SmartScreen Security Feature Bypass Vulnerability

 

Appendix B: Exploitability

This is a list of the February CVEs judged by Microsoft to be either already under active exploit in the wild  or more likely to be exploited in the wild within the first 30 days post-release. Each list is further arranged by CVE.

Exploitation detected
CVE-2024-21351Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2024-21412Internet Shortcut Files Security Feature Bypass Vulnerability
Exploitation more likely within the next 30 days
CVE-2024-21338Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21345Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21346Win32k Elevation of Privilege Vulnerability
CVE-2024-21357Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2024-21371Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21378Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-21379Microsoft Word Remote Code Execution Vulnerability
CVE-2024-21410Microsoft Exchange Server Elevation of Privilege Vulnerability

 

 Appendix C: Products Affected

This is a list of February’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family.

Windows (43 CVEs)

Critical severity
CVE-2024-20684Windows Hyper-V Denial of Service Vulnerability
CVE-2024-21357Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Important severity
CVE-2024-21304Trusted Compute Base Elevation of Privilege Vulnerability
CVE-2024-21338Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21339Windows USB Generic Parent Driver Remote Code Execution Vulnerability
CVE-2024-21340Windows Kernel Information Disclosure Vulnerability
CVE-2024-21341Windows Kernel Remote Code Execution Vulnerability
CVE-2024-21342Windows DNS Client Denial of Service Vulnerability
CVE-2024-21343Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-21344Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-21345Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21346Win32k Elevation of Privilege Vulnerability
CVE-2024-21347Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21348Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2024-21349Microsoft ActiveX Data Objects Remote Code Execution Vulnerability
CVE-2024-21350Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21352Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21353Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21354Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21355Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21356Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
CVE-2024-21358Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21359Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21360Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21361Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21362Windows Kernel Security Feature Bypass Vulnerability
CVE-2024-21363Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-21365Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21366Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21367Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21368Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21369Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21370Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21371Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21372Windows OLE Remote Code Execution Vulnerability
CVE-2024-21375Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21377Windows DNS Information Disclosure Vulnerability
CVE-2024-21391Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21405Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21406Windows Print Spooler Spoofing Vulnerability
CVE-2024-21412Internet Shortcut Files Security Feature Bypass Vulnerability
CVE-2024-21420Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21351Windows SmartScreen Security Feature Bypass Vulnerability

 

Azure (8 CVEs)

Important severity
CVE-2024-20667Azure DevOps Server Remote Code Execution Vulnerability
CVE-2024-20679Azure Stack Hub Spoofing Vulnerability
CVE-2024-21329Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-21376Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
CVE-2024-21381Microsoft Azure Active Directory B2C Spoofing Vulnerability
CVE-2024-21397Microsoft Azure File Sync Elevation of Privilege Vulnerability
CVE-2024-21403Microsoft Azure Kubernetes Services Confidential Container Elevation of Privilege Vulnerability
Moderate severity
CVE-2024-21364Microsoft Azure Site Recovery Elevation of Privilege Vulnerability

 

Dynamics 365 (8 CVEs)

Critical severity
CVE-2024-21380Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
Important severity
CVE-2024-21327Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVE-2024-21328Dynamics 365 Sales Spoofing Vulnerability
CVE-2024-21389Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21393Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21394Dynamics 365 Field Service Spoofing Vulnerability
CVE-2024-21395Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-21396Dynamics 365 Sales Spoofing Vulnerability

 

Office (5 CVEs)

Critical severity
CVE-2024-21413Microsoft Office Remote Code Execution Vulnerability
Important severity
CVE-2024-20673Microsoft Office Remote Code Execution Vulnerability
CVE-2024-21378Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-21379Microsoft Word Remote Code Execution Vulnerability
CVE-2024-21384Microsoft Office OneNote Remote Code Execution Vulnerability

 

.NET (1 CVE, shared with Visual Studio)

Important severity
CVE-2024-21404.NET Denial of Service Vulnerability

 

ASP.NET (1 CVE)

Important severity
CVE-2024-21386.NET Denial of Service Vulnerability

 

Defender (1 CVE)

Important severity
CVE-2024-21315

 

Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability

 

Entra (1 CVE)

Important severity
CVE-2024-21401Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability

 

Exchange (1 CVE)

Critical severity
CVE-2024-21410Microsoft Exchange Server Elevation of Privilege Vulnerability

 

Outlook 365 (1 CVE)

Important severity
CVE-2024-21402Microsoft Outlook Elevation of Privilege Vulnerability

 

Skype (1 CVE)

Important severity
CVE-2024-20695Skype for Business Information Disclosure Vulnerability

 

Teams for Android (1 CVE)

Important severity
CVE-2024-21374Microsoft Teams for Android Information Disclosure Vulnerability

 

Visual Studio (1 CVE, shared with ASP.NET)

Important severity
CVE-2024-21386.NET Denial of Service Vulnerability

 

Appendix D: Advisories and Other Products

This is a list of advisories and information on other relevant CVEs in the February Microsoft release, sorted by product.

Relevant to Edge / Chromium (6 CVEs)

CVE-2024-1059Chromium: CVE-2024-1059 Use after free in WebRTC
CVE-2024-1060Chromium: CVE-2024-1060 Use after free in Canvas
CVE-2024-1077Chromium: CVE-2024-1077 Use after free in Network
CVE-2024-1283Chromium: CVE-2024-1283 Heap buffer overflow in Skia
CVE-2024-1284Chromium: CVE-2024-1284 Use after free in Mojo
CVE-2024-21399Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

 

Relevant to Windows (non-Microsoft release) (one CVE)

CVE-2023-50387MITRE: CVE-2023-50387 DNS RRSIGs and DNSKEYs validation can be abused to remotely consume DNS server resources

 

Relevant to Adobe (13 CVEs)

CVE-2024-20726Security updates available for Acrobat Reader
CVE-2024-20727Security updates available for Acrobat Reader
CVE-2024-20728Security updates available for Acrobat Reader
CVE-2024-20729Security updates available for Acrobat Reader
CVE-2024-20730Security updates available for Acrobat Reader
CVE-2024-20731Security updates available for Acrobat Reader
CVE-2024-20733Security updates available for Acrobat Reader
CVE-2024-20734Security updates available for Acrobat Reader
CVE-2024-20735Security updates available for Acrobat Reader
CVE-2024-20736Security updates available for Acrobat Reader
CVE-2024-20747Security updates available for Acrobat Reader
CVE-2024-20748Security updates available for Acrobat Reader
CVE-2024-20749Security updates available for Acrobat Reader

 

http://feeds.feedburner.com/sophos/dgdY

Leave a Reply