June 2024 – Microsoft Patch Tuesday Highlights

49 security vulnerabilities were fixed in the update, one of which is categorized as critical and another as a zero-day vulnerability.

Background:

In order to strengthen Microsoft products against a range of security threats, Microsoft has issued the June 2024 Patch Tuesday updates, which include the essential fixes and security updates. 49 security vulnerabilities were fixed in the update, one of which is categorized as critical and another as a zero-day vulnerability.

The following categories of vulnerabilities are the main focus of the June 2024 Patch Tuesday:

Zero Day Vulnerability:

CVE-2023-50868: MITRE: NSEC3 Closest Encloser Proof in DNSSEC Can Cause CPU Exhaustion

A vulnerability has been identified in DNSSEC validation that could let attackers misuse standard DNSSEC protocols, designed to ensure DNS integrity, to consume excessive resources on a resolver. This can lead to a denial of service for legitimate users. The issue was disclosed in February and has since been patched in multiple DNS implementations.

Critical Vulnerability:

CVE-2024-30080 (Microsoft Message Queuing (MSMQ) RCE Vulnerability)

Microsoft created the Message Queuing (MSMQ) protocol to maintain a message queue of undeliverable messages and guarantee dependable communication between Windows devices on various networks, even in the event of a host’s temporary unavailability.

An attacker must transmit a malicious MSMQ packet to an MSMQ server in order to take advantage of this vulnerability. If the exploitation is successful, the attacker could execute code remotely on the server.

Other vulnerabilities:

• A Win32k elevation of privilege vulnerability is identified as CVE-2024-30082. If the vulnerability is properly exploited, the attacker might be able to obtain SYSTEM rights.
• An elevation of privilege vulnerability in the Windows Kernel-Mode Driver is identified as CVE-2024-35250. If the attack is successful, the attacker could obtain SYSTEM rights.
• A vulnerability pertaining to an elevation of privilege exists in the Windows Kernel-Mode Driver (CVE-2024-30084). An attacker has to win a race condition in order to take advantage of the vulnerability. If the attack is successful, the attacker could obtain SYSTEM rights.
• An elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver is identified as CVE-2024-30085. If the vulnerability is properly exploited, the attacker might be able to obtain SYSTEM rights.
• An elevation of privilege vulnerability in the Windows Win32 Kernel Subsystem is identified as CVE-2024-30086. If the attack is successful, the attacker could obtain SYSTEM rights.
• A Win32k elevation of privilege vulnerability is identified as CVE-2024-30087. The rights of the user executing the impacted application would be obtained by an attacker.
• A vulnerability pertaining to an elevation of privilege exists in the Microsoft Streaming Service (CVE-2024-30089). If the attack is successful, the attacker could obtain SYSTEM rights.
• A Win32k elevation of privilege vulnerability is identified as CVE-2024-30091. The user executing the impacted application would provide the attacker access permissions.
• The Windows Kernel contains an elevation of privilege vulnerabilities, CVE-2024-30088 and CVE-2024-30099. They require an attacker to win a race condition in order to be exploited. If the attack is successful, the attacker could obtain SYSTEM rights.

Recommendation:

To stop possible exploitation, we highly advise updating all affected products with the security updates that are currently available. 

Note: To prevent operational effects, please adhere to your organization’s patching and testing policies. 

The Message Queuing (MSMQ) service must be enabled for CVE-2024-30080 to be vulnerable. If MSMQ is not needed in your environment, you could choose to disable it to stop exploitation. 

Consider restricting incoming connections to TCP port 1801 from suspicious sources if it is not possible to disable MSMQ.

Reference:

https://msrc.microsoft.com/update-guide/releaseNote/2024-Jun