Microsoft handles 2 Windows zero-days on May Patch Tuesday
In addition to the Windows vulnerabilities exploited in the wild, admins should focus on patching multiple flaws in web browsers from Google, Microsoft and Mozilla.
Microsoft closed two Windows zero-days, but multiple vulnerabilities in several browsers will also require attention from IT this month.
For May Patch Tuesday, Microsoft addressed two Windows flaws that had been actively exploited in the wild. In total, the company resolved 60 unique new CVEs. Microsoft also republished eight CVEs for third-party software -- two from GitHub and six from Google Chrome -- that affect Microsoft products. Two vulnerabilities were publicly disclosed.
Two zero-days resolved in Windows
The first zero-day is an elevation-of-privilege vulnerability (CVE-2024-30051) that targets the Windows Dynamic Window Manager (DWM) Core Library in Windows desktop and server systems. It is rated as important with a CVSS score of 7.8. The flaw was publicly disclosed.
DWM relates to the APIs used in Windows that developers use to interact with the OS to produce visual effects on the desktop.
An attacker who successfully exploits this vulnerability can obtain system privileges on the targeted system, taking complete ownership of the device. The barrier to exploit this vulnerability is low. The attacker does not need user interaction, just basic user privileges and access to the network.
The second zero-day is security feature bypass vulnerability (CVE-2024-30040) in the Windows MSHTML platform that affects Windows desktop and server systems. It is rated important with an 8.8 CVSS score.
The vulnerability exploits flaws in the Object Linking and Embedding (OLE) technology in Microsoft 365 and Microsoft Office used to share content between applications, such as embedding an Excel spreadsheet in a Word document. The attacker needs a user to open or otherwise manipulate a specially crafted file to exploit the flaw.
Chris Goettl, vice president of product management for security products at Ivanti, said this manipulation could consist of editing a file's properties or changing its name. But he said he could only speculate based on Microsoft's vague wording.
"The other part that's interesting about this vulnerability is that while it bypasses the OLE mitigations in Microsoft 365 and Microsoft Office, the only fix listed is for the Windows OS. There is no Microsoft Office patch to download," said Goettl.
The other public disclosure is a Visual Studio denial-of-service vulnerability (CVE-2024-30046) rated important with a CVSS score of 5.9. Microsoft rates the attack complexity as high.
"Successful exploitation of this vulnerability requires an attacker to invest time in repeated exploitation attempts through sending constant or intermittent data," Microsoft wrote in its CVE notes.
Two Chrome zero-days republished by Microsoft
Google patched two critical zero-day vulnerabilities (CVE-2024-4761 and CVE-2024-4671) within the last week. Microsoft Edge browser shares the same Chromium code base, so vulnerabilities in Google Chrome also affect Edge. Microsoft released out-of-band fixes for Edge and packaged the Chrome zero-days and four other Chrome vulnerabilities (CVE-2024-4331, CVE-2024-4368, CVE-2024-4558 and CVE-2024-4559) in its May Patch Tuesday release along with a correction for an Edge spoofing vulnerability (CVE-2024-30055).
Mozilla addressed 16 vulnerabilities in its Firefox browser on May Patch Tuesday.
Chris Goettl
"Update all your browsers. That should be IT's number-one priority this month," Goettl said.
But this browser update process is easier said than done. Microsoft uses a cumulative update model for Windows, so one large update covers all OS vulnerabilities, typically forcing the user to reboot their machine to apply the patches. But web browsers work differently. The browser prompts the user to restart to apply security updates, but requests can be ignored and leave the browser in danger for an extended period.
Goettl said these types of administrative limitations are one reason why IT needs additional tools, specifically a patch management product, to maintain security on the organization's devices.
Critical vulnerability in SharePoint resolved
The only critical CVE this month is a SharePoint Server remote-code execution vulnerability (CVE-2024-30044) with an 8.8 CVSS score. Microsoft gave this flaw an assessment of "exploitation more likely."
The CVSS metrics indicate an attacker has a good chance of a successful exploit because it only requires site owner permissions and no user interaction. The attacker could then execute code in the context of SharePoint Server.
Patches for development tools require cooperation
Microsoft released two security updates for Visual Studio (CVE-2024-30046 and CVE-2024-30045), with the latter also correcting a vulnerability in the open-source .NET development platform. The company also included two remote-code execution flaws that originated with the GitHub MinGit software used in the Visual Studio coding application. Updating to the latest build of Visual Studio corrects the bug.
Security updates for Visual Studio highlight another area of concern for IT pros. A patch that resolves a vulnerability might also break specific functionality the engineering team needs to support its applications.
"The security, IT and development teams must effectively run in parallel to make sure that they're staying in sync and deciding to move forward with those changes or accepting the risk and mitigating it where possible," Goettl said.
He said a common IT challenge in the healthcare industry involves expensive medical devices that rely on unsupported versions of Windows. Upgrading these devices can be cost-prohibitive. IT administrators, responsible for maintaining functionality, must find a compromise. They can segment the device from the main network to limit access and add additional security measures. This balancing act aims to minimize operational costs while meeting security team requirements and avoiding potential audit concerns.
Tom Walat is the site editor for TechTarget Editorial's Windows Server site, where he manages all site content. Walat previously worked for a newspaper in the Greater Boston area.
