February 2024 Patch Tuesday: Microsoft Releases 72 Patches, Two For Actively Exploited Vulnerabilities

In their latest cybersecurity update for February 2024, Microsoft has rolled out a hefty suite of 72 new patches aimed at fortifying a wide array of its services against vulnerabilities, including Microsoft Windows and its components, Office suite, Azure cloud services, .NET and ASP.NET frameworks, SQL Server, Windows Hyper-V, and Microsoft Dynamics. The patch release also integrates fixes for several Chromium vulnerabilities, elevating the total count of addressed CVEs to 78. Notably, two of these vulnerabilities, patched as part of this update, were highlighted by the Zero Day Initiative (ZDI) program, with one being actively exploited at the time of the patch release.

Breaking down the severity of the patches, Microsoft categorized five as ‘Critical,’ 65 as ‘Important,’ and two as ‘Moderate.’ This distribution aligns with the typical pattern observed in Microsoft’s February updates, marking a slight dip in the volume of fixes compared to the previous year, a trend that industry watchers are keen to monitor as 2024 progresses.

Major Vulnerabilities Patched This Month

Among the patched vulnerabilities, two were flagged as being actively exploited. However, specifics regarding their public disclosure status were not provided. Here are four important ones you might want to be aware of; a full list of all patches can be found at the end:

• CVE-2024-21412: A vulnerability in Internet Shortcut Files that bypasses security features, discovered by Peter Girnus and the ZDI Threat Hunting team. This bug, currently exploited to target forex traders with a remote access trojan via online forums, is expected to see wider exploitation now that it has been disclosed. Trend Micro has already implemented protective measures for its customers, but broader testing and deployment of this fix are advised.
• CVE-2024-21351: A SmartScreen security feature bypass vulnerability in Windows, resembling a previously exploited in-the-wild (ITW) bug. This flaw allows attackers to circumvent file origin checks by Windows Defender SmartScreen, potentially leading to unauthorized code execution. The extent of the attacks leveraging this vulnerability remains undisclosed, prompting a call to action for swift patch deployment.
• CVE-2024-21410: A critical elevation of privilege vulnerability in Microsoft Exchange Server, with a CVSS score of 9.8. This bug enables remote attackers to relay NTLM credentials and impersonate Exchange server users. The remedy involves not just the application of the patch but also ensuring that the Exchange Server 2019 Cumulative Update 14 (CU14) and Extended Protection for Authentication (EPA) are in place, with Microsoft offering additional guidance for Exchange administrators.
• CVE-2024-21413: A remote code execution vulnerability in Microsoft Office that allows attackers to bypass Protected View settings, potentially enabling code execution even in Preview Pane. This vulnerability, also rated with a CVSS score of 9.8, necessitates the installation of multiple updates for both 32-bit and 64-bit versions of Office 2016, with a recommendation to close all Office applications during the update process to avoid possible reboots.

Industry-Wide Security Updates

Beyond Microsoft, the tech industry has responded to vulnerabilities with critical updates. Adobe, for example, patched 29 vulnerabilities across six of its products, including Commerce, Acrobat and Reader. SAP released 16 Security Notes, with a critical code injection vulnerability in the SAP_ABA component marked as a high alert with a 9.1 CVSS score. Intel announced fixes for 79 vulnerabilities, though none were rated critical and appeared unexploited at the time of the announcement.

Cisco updated advisories for vulnerabilities rated up to 9.6 in severity that could allow unauthenticated, remote attacks. Meanwhile, AMD addressed multiple flaws across its products, including a vulnerability in the RSA authentication mechanism of its UltraScale and UltraScale+ FPGAs. Lastly, Google’s Android security bulletin addressed around 30 CVEs, with the most critical being a system component flaw enabling remote code execution without additional execution privileges.

This raft of security updates underscores the relentless efforts by hackers to exploit vulnerabilities in widely used systems and the continued vigilance and proactive responses required by software manufacturers and users alike to protect sensitive data and maintain system integrity.

Microsoft Patch Tuesday February 2024 Updates