Microsoft Releases November 2024 Security Updates

Microsoft has released security updates to address 89 vulnerabilities in Microsoft products. The security updates include four critical vulnerabilities, two vulnerabilities that are under zero-day exploitation, and four vulnerabilities that are publicly disclosed.

• CVE-2024-43451 - NTLM Hash Disclosure Spoofing Vulnerability

CVE-2024-43451 is an 'external control of file name or path’ vulnerability in Windows and Windows Server and has a CVSSv3 score of 6.5. Successful exploitation discloses a user's NTLMv2 hash to the attacker, who could use the hash to authenticate as the user. This vulnerability is publicly known and is under active exploitation. 

• CVE-2024-49039 - Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2024-49039 is a ‘improper authentication’ vulnerability in .NET and Visual Studio 2022 with a CVSSv3 score of 8.8. An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to privileged accounts only. This vulnerability is under active exploitation.

• CVE-2024-43498 - .NET and Visual Studio Remote Code Execution Vulnerability

CVE-2024-49039 is a critical ‘type confusion’ vulnerability in .NET and Visual Studio 2022 with a CVSSv3 score of 9.8. An unauthenticated attacker could exploit this vulnerability leading to remote code execution. 

• CVE-2024-49019 - Active Directory Certificate Services Elevation of Privilege Vulnerability

CVE-2024-49019 is a ‘weak authentication’ vulnerability in Windows Server with a CVSSv3 score of 7.8. An attacker who successfully exploited this vulnerability could escalate privileges to gain domain administrator privileges. This vulnerability is publicly disclosed.

• CVE-2024-49040 - Microsoft Exchange Server Spoofing Vulnerability

CVE-2024-49040 is a ‘user interface (UI) misrepresentation of critical information’ vulnerability in Microsoft Exchange Server with a CVSSv3 score of 7.5. This vulnerability is publicly known and Microsoft has a blog post that provides additional information and explains how this vulnerability could lead to the email client (for example, Microsoft Outlook) displaying a forged sender as if it were legitimate.

• CVE-2024-43625 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

CVE-2024-43625 is a critical ‘use after free’ vulnerability with a CVSSv3 score of 8.1 that affects Windows and Windows Server. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges or lead to a scope change, which would mean that the attacker could traverse the guest's security boundary to execute arbitrary code on the Hyper-V host execution environment.

• CVE-2024-43639 - Windows Kerberos Remote Code Execution Vulnerability

CVE-2024-43639 is a critical ‘numeric truncation error’ vulnerability with a CVSSv3 score of 9.8 that affects Windows Server. An unauthenticated attacker could use a specially crafted application to leverage a cryptographic protocol vulnerability in Windows Kerberos to perform remote code execution against the target.