VERT Threat Alert: October 2024 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s October 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1127 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2024-43573

A vulnerability in the Windows MSHTML Platform has seen active exploitation attacks against a spoofing vulnerability. Based on the CWE that Microsoft selected for this vulnerability, the risk comes from a Cross-Site Scripting (XSS) attack. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-43572

A vulnerability in the Microsoft Management Console allows for code execution. While Microsoft has called this remote code execution, it is important to note that this is not a remote vulnerability. When an untrusted Microsoft Saved Console (MSC) file is opened, code execution can occur, which means that for this attack to occur remotely, an attacker must convince a user to download and open an MSC file. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-43583

A vulnerability within Winlogon could allow an attacker to gain SYSTEM privileges when using a third-party (3P) Input Method Editor (IME) to log into the system. On top of releasing an update, Microsoft has indicated that further actions must be taken to be protected from this vulnerability. Specifically, Microsoft has released a KB Article helping users enable a Microsoft first-party IME to mitigate against potential 3P IME vulnerabilities. Microsoft has reported this vulnerability as Exploitation More Likely.

CVE-2024-6197

A vulnerability exists in curl when processing a specially crafted TLS certificate. The vulnerability was introduced in curl 8.6.0 and fixed in 8.9.0. A user would need to connect to a server with a malicious TLS certificate in order for the vulnerability to be exploited. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2024-20659

A vulnerability in Hyper-V could allow for a security feature bypass but requires a number of factors to line up, which is why Microsoft has indicated that the Attack Complexity is high in the CVSS scoring. An attacker would have to convince the victim to reboot their system, the system would need to be running specific hardware allowing for a UEFI bypass, and the attacker must be on the same physical or logical network (indicated by the CVSS scoring element Attack Vector being set to Adjacent). Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted

Other Information

At the time of publication, there were no new advisories included with the October Security Guidance.