PortalFuse Weekly Security Update Report (Windows and Edge Edition) – December 10, 2024

The PortalFuse Microsoft Intune and Security Report Podcast

Welcome to "Addressing Critical CVEs: Enhancing System Security," your go-to podcast for the latest system vulnerabilities and security patch updates. In this episode, we delve into Microsoft's December 2024 updates, which tackle a range of critical vulnerabilities, from remote code execution to elevation of privilege and denial of service.

Remote Code Execution: This week, we explore several Remote Code Execution (RCE) vulnerabilities that highlight the increasing sophistication of exploits targeting core system services. Notable patches include:

• CVE-2024-49132: A Windows Remote Desktop Services RCE vulnerability caused by a race condition, allowing attackers to execute arbitrary code remotely without user interaction.
• CVE-2024-49127: An LDAP RCE vulnerability that lets attackers execute code within SYSTEM context.
• CVE-2024-49122: An MSMQ RCE vulnerability enabling remote code execution via crafted MSMQ packets.

Elevation of Privilege: We also discuss Elevation of Privilege (EoP) vulnerabilities, which are increasingly targeting local privilege escalation pathways. Key patches include:

• CVE-2024-49114: A Cloud Files Mini Filter Driver vulnerability allowing SYSTEM level privilege escalation.
• CVE-2024-49111: A WwanSvc vulnerability exploitable for sensitive resource access.
• CVE-2024-49088: A Windows Common Log File System Driver vulnerability enabling privilege escalation through buffer over-read flaws.

Denial of Service: Closing out 2024, we address Denial of Service (DoS) vulnerabilities, particularly those exploiting directory-related services like LDAP. Critical patches include:

• CVE-2024-49121: An LDAP DoS vulnerability interrupting directory lookups and authentication.
• CVE-2024-49113: An out-of-bounds read vulnerability in LDAP causing resource exhaustion.
• CVE-2024-49126: A Windows Defender DoS vulnerability leading to resource exhaustion and system crashes.

Key KB Articles: We transition to the Knowledge Base (KB) articles that provide crucial context for applying these fixes. Highlights include:

• KB5048703: Enhances security within the Windows 10 ecosystem.
• KB5048652: Focuses on improving stability for Windows 10 Version 22H2.
• KB5048794: Enhances performance and stability for Windows 11 enterprise environments.
• KB5048685: Applies to Windows 11 Enterprise and Education versions, addressing vulnerabilities in the OpenSSH subsystem and improving GPU-intensive task performance.

Wrapping Up: As we transition into 2025, prioritizing regular patch management, vulnerability assessments, and staying informed about emerging threats will be crucial for ensuring robust IT infrastructure resilience.

Thank you for tuning in to this Patch Tuesday report. Your dedication to securing systems is appreciated. Wishing you a secure and Merry Christmas from everyone at PortalFuse to you and your family!