Microsoft and Adobe Patch Multiple Security Vulnerabilities in First Update of 2024

Microsoft has released 49 security updates on the first Patch Tuesday of 2024, addressing a range of vulnerabilities including two with a critical severity rating. This month's security roundup also includes vital updates from Adobe and SAP, along with a series of patches from Google targeting the Android platform.

Key Vulnerabilities Addressed by Microsoft

Central to Microsoft's January updates is CVE-2024-20674, a particularly severe security feature bypass vulnerability in Windows Kerberos with a 9.0 CVSS rating. Microsoft reports that an attacker could exploit this vulnerability through methods such as a machine-in-the-middle (MITM) attack, sending a malicious Kerberos message to impersonate the authentication server. While such an attack necessitates access to a restricted network, making exploitation more challenging, Microsoft has indicated a heightened likelihood of exploitation.

The second critical-rated update concerns CVE-2024-20700, a Windows Hyper-V hypervisor remote code execution bug with a 7.5 CVSS score. To exploit this flaw, an attacker would need network access and although considered less likely to be targeted, those in the cybersecurity field stress the importance of promptly applying this update due to the high privileges Hyper-V operates with on affected systems. In addition to the critical vulnerabilities, Microsoft's patch bundle covers four high-severity flaws within Chromium-based Microsoft Edge.

Security Updates Across the Tech Landscape

On the software front, Adobe has deployed a single security update for Substance 3D Stager. This patch rectifies six vulnerabilities, all classified as “important” and addresses issues that could potentially lead to memory leaks and arbitrary code execution. None of these vulnerabilities were reportedly exploited prior to the release of the updates.

Shifting focus to enterprise solutions, SAP has delivered updates to fix 12 issues, with three tagged as HotNews Notes. A notable patch is directed at an escalation of privileges vulnerability in SAP Edge Integration Cell, as well as in certain applications developed with SAP's suite of development tools. In response, experts advise upgrading to the latest versions of affected libraries.

Cisco has rounded out its updates for privilege escalation vulnerabilities discovered in its Identity Services Engine (ISE) last September. While a patch has been issued for one of the CVEs, the company acknowledges that the other, CVE-2023-20193, remains without a fix. This particular vulnerability requires an authenticated administrator to exploit and is not enabled by default.

Lastly, Google's January Security Bulletin for Android resolves 59 vulnerabilities, with the most serious offering a path to local escalation of privilege. Fortunately, there is no evidence indicating that these vulnerabilities have been exploited in the wild.