Microsoft has issued patches for 73 security vulnerabilities in its February 2024 Patch Tuesday. Among these vulnerabilities are two zero-days that are reportedly being used in the wild.<\/p>\n
The two zero-day vulnerabilities have already been added to the Cybersecurity & Infrastructure Security Agency\u2019s catalog of \u00a0Known Exploited Vulnerabilities<\/a>, based on evidence of active exploitation. This means that Federal Civilian Executive Branch (FCEB) agencies need to remediate these vulnerabilities by March 5, 2024, in order to protect their devices.<\/p>\n The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The zero-days patched in this round of updates are:<\/p>\n CVE-2024-21351<\/a> (CVSS score<\/a> 7.6 out of 10): a Windows SmartScreen security feature bypass vulnerability. The vulnerability allows a malicious actor to inject code into SmartScreen and potentially gain code execution, which could potentially lead to some data exposure, lack of system availability, or both. An authorized attacker must send the user a malicious file and convince the user to open it.<\/p>\n CVE-2024-21412<\/a> (CVSS score 8.1 out of 10): an Internet Shortcut Files security feature bypass vulnerability. An unauthenticated attacker could send the targeted user a specially crafted file that is designed to bypass displayed security checks. However, the attacker would have no way to force a user to view the attacker-controlled content. Instead, the attacker would have to convince them to take action by clicking on the file link.<\/p>\n The bypassed security feature in both cases is the Mark of the Web (MOTW), the technology that ensures Windows pops a warning message when trying to open a file downloaded from the Internet. When a file is downloaded, Windows adds a ZoneId in the form of an Alternate Data Stream<\/a> to the file which is responsible for the warning message(s).<\/p>\n Another vulnerability worth keeping an eye on is CVE-2024-21413<\/a> (CVSS score 9.8 out of 10): a Microsoft Outlook remote code execution (RCE) vulnerability. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and to gain high privileges, which include read, write, and delete functionality. Microsoft notes that the Preview Pane is an attack vector. The update guide for this vulnerability<\/a> lists a number of required updates before protection is achieved.<\/p>\n Other vendors have synchronized their periodic updates with Microsoft. Here are few major ones that you may find in your environment.<\/p>\n Adobe<\/strong> has released security updates to address vulnerabilities in several products:<\/p>\n The Android<\/strong> Security Bulletin for February contains details of security vulnerabilities<\/a> for patch level 2024-02-05 or later.<\/p>\n Ivanti<\/strong> has urged customers to patch yet another critical vulnerability<\/a>.<\/p>\n SAP<\/strong> has released its February 2024<\/a> Patch Day updates.<\/p>\n We don\u2019t just report on vulnerabilities\u2014we identify them, and prioritize action.<\/strong><\/p>\n Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using\u00a0ThreatDown Vulnerability and Patch Management<\/a>.<\/p>\nOther vendors<\/h2>\n
\n
\n