Security News Microsoft April 2024 Patch Tuesday fixes 150 security flaws, 67 RCEs

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2024-patch-tuesday-fixes-150-security-flaws-67-rces/

Today is Microsoft's April 2024 Patch Tuesday, which includes security updates for 150 flaws and sixty-seven remote code execution bugs.

Only three critical vulnerabilities were fixed as part of today's Patch Tuesday, but there are over sixty-seven remote code execution bugs. More than half of the RCE flaws are found within Microsoft SQL drivers, likely sharing a common flaw.

There were also fixes for twenty-six Secure Boot bypasses released this month, including two from Lenovo.

The number of bugs in each vulnerability category is listed below:

• 31 Elevation of Privilege Vulnerabilities
• 29 Security Feature Bypass Vulnerabilities
• 67 Remote Code Execution Vulnerabilities
• 13 Information Disclosure Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

The total count of 150 flaws does not include 5 Microsoft Edge flaws fixed on April 4th and 2 Mariner flaws. Mariner is an open-source Linux distribution developed by Microsoft for its Microsoft Azure services.

Microsoft April 2024 Patch Tuesday fixes 150 security flaws, 67 RCEs

Today is Microsoft's April 2024 Patch Tuesday, which includes security updates for 150 flaws and sixty-seven remote code execution bugs.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

ZDI: The April 202 Security Updates Review

It’s the second Tuesday of the month, and Adobe and Microsoft have released a fresh crop of security updates. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.

Adobe Patches for April 2024

For April, Adobe released nine patches addressing 24 CVEs in Adobe After Effects, Photoshop, Commerce, InDesign, Experience Manager, Media Encoder, Bridge, Illustrator, and Adobe Animate. The largest of these updates is for Experience Manager, however, all of the bugs being patched are simple Cross-site Scripting (XSS) bugs. Still, if exploited, these Important-severity bugs could lead to code execution if exploited. The only other patches that address multiple CVEs are the fixes for Animate and Commerce. The patch for Animate addresses four bugs. Two of these are rated Critical and could lead to arbitrary code execution. The patch for Commerce also fixes two Critical-rated bugs, one XSS and one improper input validation bug. Both could lead to code execution.

Then we have several patches that are all info leaks due to an Out-Of-Bounds (OOB) read. These were all reported by the same person, and it makes me wonder if there is shared code between these products that makes them all vulnerable. In any case, After Effects, Photoshop, InDesign, Bridge, and Illustrator all fall into this category. That just leaves the update for Media Encoder. This patch fixes a single buffer overflow that could lead to code execution.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Adobe categorizes these updates as a deployment priority rating of 3.

Microsoft Patches for April 2024

This month, Microsoft released a whopping 147 new CVEs in Microsoft Windows and Windows Components; Office and Office Components; Azure; .NET Framework and Visual Studio; SQL Server; DNS Server; Windows Defender; Bitlocker; and Windows Secure Boot. If you include the third-party CVEs being documented this month, the CVE count comes to 155. A total of three of these bugs came through the ZDI program. None of the bugs disclosed at Pwn2Own Vancouver are fixed with this release.

Of the new patches released today, only three are rated Critical, 142 are rated Important, and two are rated Moderate in severity. This is the largest release from Microsoft this year and the largest since at least 2017. As far as I can tell, it’s the largest Patch Tuesday release from Microsoft of all time. It’s not clear if this is due to a backlog from the slower months or a surge in vulnerability reporting. It will be interesting to see which trend continues.

None of the CVEs released today are listed as currently under active attack and none are listed as publicly known at the time of release. However, the bug reported by ZDI threat hunter Peter Girrus was found in the wild. We have evidence this is being exploited in the wild, and I’m listing it as such.

Looking Ahead

The next Patch Tuesday of 2024 will be on May 14, and I’ll return with details and patch analysis then. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Zero Day Initiative — The April 2024 Security Updates Review

It’s the second Tuesday of the month, and Adobe and Microsoft have released a fresh crop of security updates. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the full video recap covering the entire release, you can check

www.zerodayinitiative.com

 

[Gandalf_The_Grey]

Microsoft releases the April 2024 Security Updates for Windows

The April 2024 security updates for Windows are now available. Microsoft released the security updates for all supported Windows versions and also other company products on today's Patch Day.

Our overview helps home users and system administrators. It offers information on the released patches and links to official Microsoft resources to look up additional information. It highlights known issues, new and fixed, links to download options, and also reveals important changes in Windows client releases.

The following Excel spreadsheet lists the security updates that Microsoft released on the April 2024 Patch Tuesday. Download the zip archive to your local computer and extract it. You can view it Excel or any compatible spreadsheet application: Windows Security Updates April 2024

Executive Summary

• Microsoft released security patches for 149 unique vulnerabilities.
• Windows clients with issues are: Windows 10 version 21H2 and 22H2
• Windows 11 has no known issues according to Microsoft.
• Windows Server clients with issues: Windows Server 2008
• The latest Windows releases include a new filter driver that prevents non-Microsoft software from setting defaults on Windows.

Microsoft releases the April 2024 Security Updates for Windows - gHacks Tech News

Microsoft released security updates for its Windows operating system on the April 2024 Patch Day. This overview provides you with information about it.

www.ghacks.net

 

[Gandalf_The_Grey]

Microsoft fixes two Windows zero-days exploited in malware attacks

Microsoft has fixed two actively exploited zero-day vulnerabilities during the April 2024 Patch Tuesday, although the company failed to initially tag them as such.

The first, tracked as CVE-2024-26234 and described as a proxy driver spoofing vulnerability, was issued to track a malicious driver signed using a valid Microsoft Hardware Publisher Certificate that was found by Sophos X-Ops in December 2023 and reported by team lead Christopher Budd.

This malicious file was labeled as "Catalog Authentication Client Service" by "Catalog Thales," likely an attempt to impersonate Thales Group. However, further investigation revealed that it was previously bundled with a marketing software called LaiXi Android Screen Mirroring.

While Sophos couldn't verify the authenticity of LaiXi software, Budd says they're confident the file is a malicious backdoor.

"Just as we did in 2022, we immediately reported our findings to the Microsoft Security Response Center. After validating our discovery, the team at Microsoft has added the relevant files to its revocation list (updated today as part of the usual Patch Tuesday cycle; see CVE-2024-26234)," Budd said.

The second zero-day silently patched today by Microsoft is tracked as CVE-2024-29988 and described as a SmartScreen prompt security feature bypass vulnerability caused by a protection mechanism failure weakness.

CVE-2024-29988 is a bypass for the CVE-2024-21412 flaw and was reported by Peter Girnus of Trend Micro's Zero Day Initiative and Google's Threat Analysis Group Dmitrij Lenz and Vlad Stolyarov.

ZDI's Head of Threat Awareness Dustin Childs tagged it as actively used in attacks to deploy malware on targeted Windows systems after evading EDR/NDR detection and bypassing the Mark of the Web (MotW) feature.

"This vulnerability is related to CVE-2024-21412, which was discovered by ZDI threat researchers in the wild and first addressed in February," Childs told BleepingComputer.

"The first patch did not completely resolve the vulnerability. This update addresses the second part of the exploit chain. Microsoft did not indicate they were patching this vulnerability, so it was a (welcome) surprise when the patch went live."

The financially motivated Water Hydra hacking group that exploits CVE-2024-29988 also used CVE-2024-21412 as a zero-day on New Year’s Eve to target forex trading forums and stock trading Telegram channels in spearphishing attacks that deployed the DarkMe remote access trojan (RAT).

CVE-2024-21412 was itself a bypass for another Defender SmartScreen vulnerability tracked as CVE-2023-36025, patched during the November 2023 Patch Tuesday and exploited as a zero-day to drop Phemedrone malware.

Microsoft fixes two Windows zero-days exploited in malware attacks

Microsoft has fixed two actively exploited zero-day vulnerabilities during the April 2024 Patch Tuesday, although the company failed to initially tag them as such.

www.bleepingcomputer.com