The January 2024 Security Update Review

Welcome to the first patch Tuesday of 2024. As expected, Microsoft and Adobe have released their latest security patches. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:

Adobe Patches for January 2024

For January, Adobe released a single patch addressing six CVEs in Substance 3D Stager. All six bugs are rated Important with the most severe allowing arbitrary code execution.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Adobe categorizes these updates as a deployment priority rating of 3.

Microsoft Patches for January 2024

This month, Microsoft released 49 new patches addressing CVEs in Microsoft Windows and Windows Components; Office and Office Components; Azure; .NET Framework and Visual Studio; SQL Server; Windows Hyper-V; and Internet Explorer. In addition to the new CVEs, multiple Chromium bugs are being incorporated into the release, bringing the total number of CVEs to 53.

Of the new patches released today, two are rated Critical and 47 are rated Important in severity. This release is coincidentally the same number of CVEs addressed in both the January 2019 and January 2020 releases.

None of the CVEs released today are listed as publicly known or under active attack at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with a security feature bypass in Kerberos:

-       CVE-2024-20674 – Windows Kerberos Security Feature Bypass Vulnerability
This is the highest-rated CVSS for this month and one of the two Critical-rated patches. The bug would allow an unauthenticated attacker to perform a machine-in-the-middle (MitM) that spoofs a Kerberos server. An affected client would receive what they believe to be authentic messages from the Kerberos authentication server. While this would certainly take some setting up, Microsoft does give the bug its highest exploitability index rating (1), which means they expect to see public exploit code within 30 days. Make sure to test and deploy this update quickly.

-       CVE-2024-20700 – Windows Hyper-V Remote Code Execution Vulnerability
This is the other Critical-rated patch for January, although “remote” in this case actually means network adjacent. Microsoft doesn’t provide much of a description beyond that, so it’s not clear how the code execution would occur. However, they do note that neither authentication nor user interaction is required, which makes this vulnerability quite juicy to exploit writers. Although winning a race condition is required for successful exploitation, we’ve seen plenty of Pwn2Own winners use race conditions in their exploits.

-       CVE-2024-0056 – Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Besides being a mouthful of a title, this SFB bug could allow an MITM attacker to decrypt, read, or modify TLS traffic between an affected client and server. If you happen to be using these data providers, you’ll also need to take additional steps to be fully protected. The bulletin lists the additional NuGet packages you’ll need to load to completely resolve this vulnerability. Microsoft links to an article that claims to provide further information on the steps admins need to take to be protected, but as of now, that link leads nowhere. I’ll update the blog once they update the link to something relevant. Note: Microsoft has updated the link to point to the article here.

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Moving on to the other code execution bugs, most are of the “open and own” variety, where an attacker must convince a user to open a malicious file or browse to a specially crafted site to get arbitrary code execution. However, there are a couple of fixes that stand out. The first is an RCE in Office through FBX files. Microsoft is taking the unusual step of disabling that file type from being embedded within Office documents. However, they note “3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time.” Here are some additional details about this change. According to Microsoft, you may not need the fix for the Printer Metadata Troubleshooter if you’ve already installed the tool listed in KB5034510. I would still apply the update to ensure the problem is fully addressed. There’s a fix for an RCE in RDP, but it’s in the client, not the server so that greatly reduces the threat of exploitation. The one Azure-related code execution bugs require specific privileges to be exploited. The SharePoint bug requires authentication, but anyone on the SharePoint site has the privileges needed to exploit this bug and take over the system. The bug in ODBC requires connecting to a malicious database. The bugs in Libarchive require the attacker to be authenticated as a guest user on the target system. The final RCE fix is found in OCSP. This bug requires an authenticated user to be assigned the “manage online responder” permission, which is typically reserved for privileged users. Still, now may be a good time to audit your domain to confirm which users have this permission.

There are only ten elevation of privilege (EoP) patches in this month’s release, and all but oneof them require an attacker to run a specially crafted program on an affected system and lead to executing code at SYSTEM level. These types of bugs are usually paired with a code execution bug in the wild to take over a system. The lone exception to this is the bug in the Virtual Hard Disk, which could allow an attack to escalate privileges when processing “.vhdx” files in the kernel.

Looking at the 11 different information disclosure bugs in this release, the majority of these merely result in info leaks consisting of unspecified memory contents. There are only two notable exceptions. The first is in Local Security Authority Subsystem Service (LSASS) and could allow an attacker to gain network secrets when an affected client connects to an AD Domain Controller. Microsoft notes this could be done by either sniffing traffic on a network or by running a malicious script. I don’t expect to see a lot of exploitation of this vulnerability, but it would be an interesting method of lateral movement after an initial compromise. The bug in TCP/IP requires an MITM attacker, but successful exploitation could lead to revealing unencrypted contents of IPsec packets from other sessions on a server.

In addition to the two I’ve already mentioned, there are five additional SFB patches released this month. The patch for .NET Framework and Visual Studio fixes a bug that could allow attackers to improperly validate X.509 certificates. That’s similar to the bug in the Windows Server Key Distribution Service. The bug in Hypervisor-Protected Code Integrity (HVCI) is specific to certain Microsoft Surface devices. The vulnerability incorrectly allows certain kernel-mode pages to be marked as Read, Write, Execute (RWX) even with HVCI enabled. As expected, the bypass for BitLocker allows an attacker to bypass BitLocker protections. And you may have thought it was completely gone, but there’s a patch for Internet Explorer that addresses a bug that could allow bypassing zone restrictions.

The January release includes six fixes for denial-of-service (DoS) bugs, but Microsoft does not provide any real information for most of them. The bug in Hyper-V could allow a guest OS to somehow impact other guest OSes on the same hypervisor. 

Lastly, there are four spoofing bugs receiving fixes this month. The bug in the Nearby Sharing feature could be triggered by an attacker with a similarly-named machine. I would love to see additional details on this one and find out how close the machine names need to be. The bug in the Azure Stack requires clicking a specially crafted URL. User interaction is also required for the Themes bug, but Microsoft notes you can disable NTLM as a mitigation. You’re not actually using NTLM, are you? You can also add a group policy to restrict outgoing NTLM traffic to remote servers. The bug in Bluetooth requires the attacker to both be in close proximity to a target and have a paired Bluetooth device.

No new advisories were released this month.

Looking Ahead

The next Patch Tuesday of 2024 will be on February 13, and I’ll return with details and patch analysis then. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!