Microsoft’s Latest Patch Tuesday: Addressing 67 Vulnerabilities, Including Critical SharePoint Flaw and Exploited Zero-Day

Hot Take:

Another month, another patch parade! Microsoft is out here playing whack-a-mole with vulnerabilities, featuring everything from SharePoint shenanigans to desktop domination attempts. With a mix of critical, important, and ‘please fix this now’ patches, it’s like a cybersecurity buffet—except you really don’t want seconds.

• A total of 67 vulnerabilities were patched, including 1 critical Remote Code Execution (RCE) affecting Microsoft SharePoint Server.
• The crown jewel of this patch Tuesday is CVE-2024-30044, where SharePoint could potentially let attackers run amok with the right file and a crafty API call.
• Watch out for CVE-2024-30051, a zero-day elevation of privilege bug in Windows DWM Core Library that’s currently being exploited to gain SYSTEM privileges.
• Visual Studio’s MinGit got caught letting paths wander where they shouldn’t, leading to potential RCE—patched now, so breathe out.
• The highest CVSS score of the month goes to the MinGit vulnerability at a whopping 9.0. That’s definitely not a number you want associated with your software vulnerabilities.

Need to know more?

SharePoint’s Share of Problems

Let’s talk about the star of this month’s security show: CVE-2024-30044. It’s not just any vulnerability; it’s a critical one with a flair for the dramatic. Imagine being a site owner and finding out that your seemingly innocent file upload could turn into a full-blown server takeover. It’s like thinking you’re uploading a cute cat video, only to realize it’s a Trojan cat ready to pounce!

The Zero-Day Hero

Then there’s the zero-day vulnerability CVE-2024-30051, already out in the wild and exploiting Windows DWM Core Library. This vulnerability doesn’t just knock on the door; it kicks it down and throws a party in SYSTEM privileges. If vulnerabilities had a VIP list, this one would be at the top, waving its exploitation rights like a golden ticket.

Path Traversal Party Crashers

And let’s not forget the party crasher CVE-2024-32002 in MinGit. It’s like inviting someone to a potluck and they bring a dish that nobody can eat. This path traversal issue could let attackers serve up a side dish of RCE, which definitely isn’t on the menu at Microsoft Visual Studio’s dinner parties anymore.

A Patchwork of Patches

With vulnerabilities ranging from important to critical, and impacts from remote code execution to information disclosure, it’s a veritable smorgasbord of security issues. Microsoft’s patch list is like a grocery list that keeps getting longer—just when you think you’ve ticked off everything, you remember you’re out of milk…or in this case, out of patches.

The CVSS Scoreboard

And for those keeping score at home, the CVSS ratings are like a cybersecurity Olympics, but where high scores are bad and no one wants to take home the gold. With SharePoint and MinGit taking the top spots this month, it’s a reminder that in the game of patches, you either win or you… well, patch urgently.

So, grab your digital toolkits and start patching, because vulnerabilities wait for no one, and this patch parade is one you can’t afford to miss!