February’s Patch Tuesday treats customers to 72 patches

After a light start to the year, February delivered 72 patches and 21 advisories to Microsoft customers. The CVEs addressed in this month’s Patch Tuesday release included 43 for Windows. Twelve other product groups or tools are also affected. Of the CVEs addressed, five are considered Critical in severity by Microsoft; these affect Windows, Office, Exchange, and Dynamics 365.

At patch time, two of the issues are known to be under exploit in the wild, and none has been publicly disclosed. (However, one of the advisory items most certainly has; more on that in a minute.) Eight of the addressed vulnerabilities in Windows, Office, and Exchange (including a Critical-severity elevation-of-privilege issue with an attention-getting 9.8 CVSS base score) are by the company’s estimation more likely to be exploited in the next 30 days. Six of the issues addressed are covered by Sophos protections, and we include information on those in a table below.

In addition to these patches the release included information on six Chromium/Edge-related CVEs, including an RCE that could lead to sandbox escapes; one MITRE-issued CVE concerning a DNS issue that could lead to denial of service; one Github-issued CVE addressing the recent CVE-2024-21626 “Leaky Vessel” issue affecting Mariner, disclosed in a lengthy public post by Snyk two weeks ago and patched by various other affected companies since then; and 13 Adobe advisories, all related to Acrobat Reader.

We don’t include advisories in the CVE counts and graphics below, but we provide information on everything in an appendix at the end of the article. We are as usual including at the end of this post three other appendices listing all Microsoft’s patches, sorted by severity, by predicted exploitability, and by product family.

• Total Microsoft CVEs: 72
• Total Adobe advisories covered in update: 13
• Total Edge / Chromium issues covered in update: 6
• Total Mariner advisories covered in update: 1
• Total MITRE advisories covered in update: 1
• Publicly disclosed: 0
• Exploited: 2
• Severity
  • Critical: 5
  • Important: 65
  • Moderate: 2
• Impact
  • Remote Code Execution: 30
  • Elevation of Privilege: 16
  • Spoofing: 10
  • Denial of Service: 8
  • Information Disclosure: 5
  • Security Feature Bypass: 3

Figure 1: After January’s big month for information disclosure bugs, a wealth of OLE-related fixes put remote code execution back on top for February

Products

• Windows: 43
• Azure: 8
• Dynamics 365: 8
• Office: 5
• .NET: 1
• ASP.NET: 1 (shared with Visual Studio)
• Defender: 1
• Entra [Azure AD]: 1
• Exchange: 1
• Outlook 365: 1
• Skype: 1
• Teams for Android: 1
• Visual Studio: 1 (shared with ASP.NET)

Figure 2: It’s a Windows-heavy month, thanks in part to a large number of fixes for Windows Defender Application Control (WDAC)

Notable February updates

In addition to the issues discussed above, a few specific items are worth noting.

CVE-2024-21350, CVE-2024-21352, CVE-2024-21358, CVE-2024-21359, CVE-2024-21360, CVE-2024-21361, CVE-2024-21365, CVE-2024-21366, CVE-2024-21367, CVE-2024-21368, CVE-2024-21369, CVE-2024-21370, CVE-2024-21375, CVE-2024-21391 (15 CVEs)

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Fifteen CVEs that share not only a name but a severity (Important), an impact (RCE), a lofty CVSS base score (8.8), and a finder non-identification (Microsoft credits all 15 to “Anonymous”). They’re accompanied by one additional (but related?) patch that shares everything but the number and name – CVE-2024-21353, Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability.

CVE-2024-21404
Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability

This extra-spicy EoP – Microsoft assigns it only an Important severity rating, but its base CVSS is a critical-level 9.8 – targets the Azure AD Jira SSO plugin. Significantly, it doesn’t even require the attacker to authenticate to cause trouble; all it takes is a script to access a targeted Jira server, and the attacker will be able to update Entra ID SAML metadata and information for the plugin – allowing them to change the authentication of the application as they wish. The fix is an update to version 1.1.2; it’s available from either the Microsoft Download Center or from the Atlassian Marketplace.

CVE-2024-21410
Microsoft Exchange Server Elevation of Privilege Vulnerability

The other CVE with a 9.8 CVSS this month is a NTLM relay (pass-the-hash) vulnerability. It could allow the attacker to relay a user’s leaked Net-NTLMv2 hash against a vulnerable Exchange Server and authenticate as the user. It affects a hodge-podge of versions: Exchange Server 2016, cumulative update 23; Exchange Server 2019, cumulative update 13; and Exchange Server 2019, cumulative update 14. More information is available on Microsoft’s Exchange Team Blog, but know that the company believes this one is more likely to be exploited within the next 30 days.

CVE-2024-21378
Microsoft Outlook Remote Code Execution Vulnerability

Preview Pane is an attack vector for this important-severity RCE, and Microsoft believes that exploitation is more likely in the next 30 days. The race is on.

CVE-2024-21374
Microsoft Teams for Android Information Disclosure

The patch for this important-severity information disclosure issue is available via Google Play.

Figure 3: 2024’s off and trotting – though, with just 120 patches so far, totals are running substantially behind other years. (The first two months of 2023 brought 173 patches; 2022, 154; 2021, 139; and 2020, 150.)

Sophos protections

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Windows Update Catalog website. Run the winver.exe tool to determine which build of Windows 10 or 11 you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of February patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE.

Remote Code Execution (30 CVEs)

Elevation of Privilege (16 CVEs)

Spoofing (10 CVEs)

Denial of Service (8 CVEs)

Information Disclosure (5 CVEs)

Security Feature Bypass (3 CVEs)

Appendix B: Exploitability

This is a list of the February CVEs judged by Microsoft to be either already under active exploit in the wild  or more likely to be exploited in the wild within the first 30 days post-release. Each list is further arranged by CVE.

 Appendix C: Products Affected

This is a list of February’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family.

Windows (43 CVEs)

Azure (8 CVEs)

Dynamics 365 (8 CVEs)

Office (5 CVEs)

.NET (1 CVE, shared with Visual Studio)

ASP.NET (1 CVE)

Defender (1 CVE)

Entra (1 CVE)

Exchange (1 CVE)

Outlook 365 (1 CVE)

Skype (1 CVE)

Teams for Android (1 CVE)

Visual Studio (1 CVE, shared with ASP.NET)

Appendix D: Advisories and Other Products

This is a list of advisories and information on other relevant CVEs in the February Microsoft release, sorted by product.

Relevant to Edge / Chromium (6 CVEs)

Relevant to Windows (non-Microsoft release) (one CVE)

Relevant to Adobe (13 CVEs)