Microsoft Patches Actively Exploited Vulnerability and More

December Patch Tuesday: A Mild But Critical Update

December’s Patch Tuesday was relatively mild, with 70 vulnerabilities fixed, of which 16 were classified as critical. However, the focus was on a few vulnerabilities that had already been actively exploited, making the updates essential for cybersecurity professionals to implement quickly.

Tyler Reguly, the Associate Director of Security R&D at Fortra, a cybersecurity software and services company, noted in an email to TechRepublic, “This year, cybersecurity professionals must be on Santa’s nice list, or, at the very least, Microsoft’s.” This highlights the growing need for vigilance, especially with the recent wave of vulnerabilities.

Microsoft Patches Critical CLFS Vulnerabilities

One of the standout fixes in this Patch Tuesday was CVE-2024-49138, an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver. The CLFS driver plays a critical role in Windows, handling transaction logs. A flaw in its bounds checking could allow attackers to gain SYSTEM privileges, which could lead to data theft or the installation of backdoors.

Mike Walters, president and co-founder of Action1, explained, “Given that CLFS is a standard component across multiple versions of Windows, including server and client installations, the vulnerability has extensive reach, especially in enterprise environments.” He emphasized that addressing this issue should be a high priority, especially since the vulnerability has already been exploited.

Interestingly, Microsoft had already released patches for eight other CLFS vulnerabilities this year. According to Reguly, this marks an improvement compared to previous years, with 12 CLFS vulnerabilities patched in 2022 and 10 in 2023. Despite progress, this trend signals ongoing concerns regarding the security of Microsoft’s CLFS implementation.

Remote Code Execution Risks: CVE-2024-49112

Another critical vulnerability in the December update was CVE-2024-49112, which scored 9.8 on the CVSS severity scale, indicating a significant risk. This vulnerability allows attackers to execute remote code within the Windows Lightweight Directory Access Protocol (LDAP) service, which is integral to directory services.

“Windows Server systems acting as domain controllers (DCs) are especially at risk, given their crucial role in managing directory services,” Walters explained. He noted that systems with internet-facing domain controllers should take immediate action to patch this flaw.

Reguly added, “Companies following the Department of Defense’s DISA STIG for Active Directory Domains should already have blocked domain controllers from internet connections,” highlighting best practices in securing domain controllers. This reminder serves as a valuable tip for organizations seeking to reduce their cybersecurity risks.

Understanding the Threat of Remote Code Execution

The risk of remote code execution was a recurring theme in December’s patch cycle. In total, nine vulnerabilities were related to this type of threat. As Walters pointed out, “Organizations should avoid exposing RDP services to the global internet and implement robust security controls to mitigate risks.” He stressed the dangers of leaving Remote Desktop Protocol (RDP) services open and unprotected, underscoring the importance of securing network access points.

Reguly also remarked on Microsoft’s consistency in patching vulnerabilities year after year. While it would be ideal to see the number of vulnerabilities decrease, the consistency of these updates provides a predictable pattern for organizations to follow. He expressed hope that with Microsoft’s commitment to the CISA’s Secure by Design pledge, these numbers might start to drop in the future.

Security Updates from Other Major Companies

While Microsoft took center stage in the December Patch Tuesday, other tech giants also rolled out significant updates to address vulnerabilities. These updates are essential for maintaining cybersecurity across different platforms.

Adobe’s Security Updates

As usual, Adobe provided a list of critical security updates in its monthly release. These patches are crucial for users of Adobe’s software, which is widely used across enterprises and individual users. Keeping Adobe products updated is key to preventing exploitation of known vulnerabilities.

Google Chrome and Mozilla Firefox Patches

Both Google and Mozilla released patches for vulnerabilities in their popular web browsers, Chrome and Firefox. These browsers are frequently targeted by cybercriminals, so it’s important for users to stay on top of these updates to avoid potential exploits.

Cisco NX-OS Security Updates

Cisco also provided updates for over 100 devices running the NX-OS operating system. Cisco’s updates are particularly relevant for organizations using its data center solutions, as vulnerabilities in these systems can have widespread consequences for enterprise-level infrastructure.

Linux Privilege Escalation Fixes

Linux users also saw fixes for several local privilege escalation vulnerabilities, which could allow attackers to escalate their privileges on vulnerable systems. Organizations using Linux in their infrastructure should prioritize these patches to safeguard their systems.

Zero-Day Patches for Macs with Intel Chips

Apple users weren’t left out, as two zero-day vulnerabilities affecting Macs with Intel processors were patched in December. These actively exploited vulnerabilities were a major security concern for macOS users, and the timely release of patches was crucial to prevent further exploitation.

Key Takeaways: What You Need to Know

1. Microsoft’s Critical CLFS Patch: CVE-2024-49138 is a critical patch for Windows Common Log File System (CLFS) vulnerabilities. This issue has already been exploited, making it a high priority for organizations to address.
2. Remote Code Execution Vulnerabilities: CVE-2024-49112, with a CVSS score of 9.8, is a severe remote code execution flaw in Windows LDAP. This vulnerability is especially dangerous for domain controllers, and organizations should ensure they are not exposed to the internet.
3. RDP and Network Security: Remote Desktop Protocol (RDP) services continue to be a major security risk. Organizations should take steps to secure these services and avoid exposing them to the internet.
4. Other Major Updates: Alongside Microsoft, companies like Adobe, Google, Mozilla, Cisco, and Apple also rolled out critical security patches. These updates are crucial to maintaining the integrity of your systems.
5. Consistent Security Patching: While the number of vulnerabilities fixed by Microsoft remains high, the company’s consistent patching is a step in the right direction. Enterprises should continue to follow best practices for patch management and ensure all systems are updated regularly.

Final Thoughts on December’s Patch Tuesday

December’s Patch Tuesday highlights the importance of staying proactive in addressing security vulnerabilities. From critical CLFS vulnerabilities to remote code execution risks, the need for timely patching has never been more urgent. With patches released by Microsoft and other major tech companies, organizations must ensure they are up to date on the latest fixes to protect their systems and data.

For a complete list of security updates, visit the official Microsoft Support page. Ensure that your organization is implementing these patches to mitigate the risks of exploitation.