The July 2024 Security Update Review

We’re just past the halfway point of 2024, and as expected, Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2024

For July, Adobe released three patches addressing seven CVEs in Adobe Premiere Pro, InDesign, and Adobe Bridge. The patch for InDesign is the largest, fixing four Critical-rated CVEs. All four could lead to arbitrary code execution. The fix for Premiere Pro fixes a single CVE that could lead to arbitrary code execution. Finally, the fix for Bridge fixes one Critical rated and one Important rated bug. The Critical-rated bug could lead to code execution while the other bug is a memory leak. After such a huge Adobe release last month, it’s nice to see a smaller one this month.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Adobe categorizes these updates as a deployment priority rating of 3.

Microsoft Patches for July 2024

This month, Microsoft released a gargantuan 139 new CVEs in Windows and Windows Components; Office and Office Components; .NET and Visual Studio; Azure; Defender for IoT; SQL Server; Windows Hyper-V; Bitlocker and Secure(?) Boot; Remote Desktop; and Xbox (yes Xbox!). If you include the third-party CVEs being documented this month, the CVE count comes to 142. One of these cases came through the ZDI program.

Of the patches being today, five are rated Critical, 133 are rated Important, and three are rated Moderate in severity. This release is another huge bunch of fixes from Redmond, just shy of the record 147 CVEs from back in April this year.

Two of these CVEs are listed as publicly known, with one of those being a third-party update that’s now being integrated into Microsoft products. Two other bugs are listed as being under active attack. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerabilities currently being exploited:

-       CVE-2024-38080 – Windows Hyper-V Elevation of Privilege Vulnerability
This vulnerability could allow an authenticated threat actor to execute code with SYSTEM privileges. While not specifically stated by Microsoft, let’s assume the worst-case scenario and say that an authorized user could be on a guest OS. Microsoft also does not state how widespread the exploitation is, but this exploit would prove quite useful for ransomware. If you’re running Hyper-V, test and deploy this update quickly.

-       CVE-2024-38112 – Windows MSHTML Platform Spoofing Vulnerability
This bug is listed as “Spoofing” for the impact, but it’s not clear exactly what is being spoofed. Microsoft has used this wording in the past for NTLM relay attacks, but that seems unlikely here. Given the researcher who reported this to Microsoft, we’ll likely see additional analysis from them soon. The good news is that a user would need to click a link to be affected. The bad news is that users click anything.

-       CVE-2024-38077 – Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
This is one of three Remote Desktop Licensing RCEs getting fixed this month, and all have a CVSS rating of 9.8. Exploitation of this should be straightforward, as any unauthenticated user could execute their code simply by sending a malicious message to an affected server. As a temporary workaround, you could disable the Licensing Service, but if you’re running it, you likely need it. I would also ensure these servers are not addressable to the Internet. If a bunch of these servers are Internet-connected, I would expect exploitation soon. Now is also a good time to audit your servers to ensure they aren’t running any unnecessary services.

-       CVE-2024-38060 – Microsoft Windows Codecs Library Remote Code Execution Vulnerability
This bug does require the attacker to be authenticated, but any authenticated user could abuse it. It simply requires an authenticated user to upload a specially crafted TIFF image to an affected system. This would be a nifty method for lateral movement once an initial foothold has been achieved. There are no workarounds either, so test and deploy the patch quickly.

-       CVE-2024-38023 – Microsoft SharePoint Server Remote Code Execution Vulnerability
This vulnerability also requires authentication, but any SharePoint user with Site Owner permissions can hit it. However, the default configuration of SharePoint allows authenticated users to create sites. That’s why I disagree with Microsoft’s CVSS rating here. By changing “Privileges Required” to low instead of high, it takes it from a 7.2 to (IMHO) more accurate 8.8. We blogged about this type of bug in the past. These types of bugs have been exploited in the past, so if you’re running SharePoint, don’t disregard or delay implementing this fix.

Here’s the full list of CVEs released by Microsoft for July 2024:

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

There are a total of 59 code execution bugs in this release, which is more CVEs than the entire June release. However, 38 of these are related to SQL Server and require a user to connect to a malicious SQL server database. That does seem unlikely, but it could be used as a post-exploitation technique for lateral movement. There’s an interesting bug in the Windows Multipoint Service, but it requires the service to be restarted for an attack to succeed. The one, new publicly known bug this month is in .NET Framework and Visual Studio. It’s an interesting race condition, but it seems unlikely to be exploited. There are the standard open-and-own Office bugs, including one that requires multiple security updates to fully address the vulnerability. Be sure to check for the “†” in the above table. There are some authenticated RCEs in the Performance Data Helper Library, but these require elevated permissions. There are additional SharePoint fixes, but it’s not clear why these are rated Important instead of Critical. There’s a scary-sounding bug in the DHCP server, but it also requires high privileges. That’s the same for the bug in Windows DTC. There’s a bug for adjacent attackers to use in the Layer-2 Bridge Network Driver. It’s not often you see exploits that low on the OSI model, but this one doesn’t require authentication. The final RCE fixes for this month happen in components you don’t expect to see patches for. The first is in the Azure Kinect SDK. Yes – that Kinect. It requires someone actually plug in a malicious USB drive to an affected system. The Kinect SDK is available for Windows and Linux, but it’s not clear if the fix covers both. Then there are fixes for the Xbox and Xbox Wireless Controller. For the Xbox, an unauthenticated attacker could get code execution by sending a malicious networking packet to an adjacent console that employs a Wi-Fi networking adapter. That’s the same scenario for the controller. Obviously, an attacker would need to be in close proximity to achieve this exploit.

There are a couple dozen fixes for Elevation of Privilege (EoP) bugs in this release, but most of these either lead to SYSTEM-level code execution or administrative privileges if an authenticated user runs specially crafted code. The bug in the Text Services Framework could be used as a sandbox or AppContainer escape. The bug in Defender for IoT could also be used as an AppContainer escape. Two of the PowerShell bugs allow a threat actor to go from a restrained user to an unrestrained WDAC user. PowerShell is often used for post-exploitation for lateral movement, so this technique would be handy for those living off the land. The bug is the Workstation Service could allow an attacker to overwrite critical structures of the service, leading to arbitrary memory writing or control flow hijacking. Not exactly a common technique, but it does lead to a privilege escalation. Finally, the bug in Azure CycleCloud could allow an authenticated user to escalate to the Administrator role on affected Azure CycleCloud instances. If you’re using this component, you need to update your CycleCloud VMs. If you aren’t familiar with that process, Microsoft provides some guidance here.

There are also two dozen fixes for security feature bypass (SFB) bugs, although I think we need to rename a component. Between 23 fixes in April and 20 more this month, I don’t think we can really call it Secure Boot anymore. Even worse, all but two of these could be exploited by an Adjacent attacker with LAN access to the target. Oof. I’m calling this feature “Protected Boot” rather than “Secure Boot”. The SFB bug in BitLocker requires physical access, but BitLocker is specifically designed to prevent this sort of attack, so…er…not good. The SFB in cryptographic services requires a SHA1 hash collision. The bug in the Windows Enroll Engine could allow a threat actor to avoid certificate validation during the enrollment process, but the exploitation would be complicated.

There are only nine information disclosure bugs receiving fixes this month and most only result in info leaks consisting of unspecified memory contents. There are only two exception. The bug in the on prem version of Dynamics 365 discloses data stored in the underlying datasets in Dataverse. This could include Personal Identifiable Information (PII). The bug in SharePoint could disclose data from the targeted website including IDs, tokens, cryptographic nonces, or other sensitive information.

There are quite a few Denial-of-Service (DoS) bugs in the July release, but Microsoft provides very little information about the details. It would be nice to know if these are blue screens or just a service-level DoS. We do know that the bugs in the iSCSI service and the Layer-2 Bridge Network driver require the attacker to be adjacent. The same goes for the bug in the Line Printer Daemon Service and the Network Driver Interface Specification. Lastly, one of the DoS bugs in the Remote Desktop Licensing Service requires some extra steps beyond the patch. According to Microsoft, “If your RD session hosts and RD licensing servers are joined to a workgroup, you need to ensure that your RD session hosts have the necessary credentials to access your RD licensing servers.” You can find additional information about that here.

The July release is rounded out by a few spoofing bugs. Probably the most important of these is the bug in Outlook that could result in NTLM relaying. Fortunately, the Preview Pane is not an attack vector. Although not specifically stated, one would assume the same for the NTLM spoofing bug. And while not as clear, one would assume the same for the spoofing bug in Themes as Microsoft lists disabling NTLM as a workaround. Finally, the bugs in Azure DevOps Server are listed as spoofing, but they could also be used for DoS or Information Disclosure.

There are no new advisories in this month’s release.

Looking Ahead

The next Patch Tuesday of 2024 will be on August 13, and I’ll return with details and patch analysis then. I’ll also be at Black Hat and DEFCON, so if you’re there, I’d love to chat about all things patches and bug bounties. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!