Microsoft releases massive July patch addressing 142 flaws, including critical and actively exploited

Microsoft has released its July 2024 Patch Tuesday updates, addressing 142 security vulnerabilities across its product suite. This includes two zero-day vulnerabilities currently being exploited and two others publicly disclosed. Among these fixes, five are critical, all involving remote code execution (RCE).

Actively Exploited Zero-Day Vulnerabilities:

1. CVE-2024-38080 (CVSS score 7.8) Windows Hyper-V Elevation of Privilege Vulnerability - Allows attackers to gain SYSTEM privileges via Hyper-V. Exploitation could lead to full system control.

2. CVE-2024-38112 (CVSS score 7.5) Windows MSHTML Platform Spoofing Vulnerability - Exploitation requires sending a malicious file to the victim who must execute it, allowing spoofing attacks.

Publicly Disclosed Zero-Day Vulnerabilities:

1. CVE-2024-35264 (CVSS score 8.1) .NET and Visual Studio Remote Code Execution Vulnerability - Allows RCE via closing an HTTP/3 stream while the request body is processed, leading to a race condition.

2. CVE-2024-37985 (CVSS score 5.9) Systematic Identification and Characterization of Proprietary Prefetchers - FetchBench side-channel attack enabling attackers to view heap memory from privileged processes.

Critical Vulnerabilities:

1. CVE-2024-38023 Microsoft SharePoint Server RCE - Allows authenticated attackers with Site Owner permissions or higher to execute RCE via malicious API requests.

2. CVE-2024-38060 Windows Imaging Component RCE - Exploitation via specially crafted TIFF images uploaded by an authenticated attacker.

3. CVE-2024-38074, CVE-2024-38076, CVE-2024-38077 Remote Desktop Licensing Service RCE - Allow remote code execution through crafted packets or messages.

Additionally, Morphisec researchers have raised a warning about CVE-2024-38021, a zero-click RCE vulnerability in most Microsoft Outlook applications that does not require authentication. This vulnerability, rated "Important" by Microsoft, can lead to data breaches and unauthorized access, with zero-click exploitation possible from trusted senders and one-click required from untrusted senders.

Microsoft urges all users to prioritize updating their systems to address these vulnerabilities, especially those involving Hyper-V, MSHTML, and RCE vulnerabilities. For environments where immediate updates are not possible, mitigation strategies such as disabling the affected services and restricting access can reduce the risk.

Details of vulnerabilities

• Remote Code Execution (RCE): 59 vulnerabilities
• Elevation of Privilege: 26 vulnerabilities
• Security Feature Bypass: 24 vulnerabilities
• Information Disclosure: 9 vulnerabilities
• Denial of Service: 17 vulnerabilities
• Spoofing: 7 vulnerabilities