Randy Franklin Smith's Ultimate Windows Security

Upcoming Webinars

The Advantages and Limitations of MFA: A Look into Common Bypass Techniques and Security Counter Measures

Webinar Library

Latest Blogs

How to Detect Pass-the-Hash Attacks Blog Series

Come meet Randy in Orlando at Microsoft Ignite at Quest's Booth #1818

Detecting Pass-the-Hash with Honeypots

Catch Malware Hiding in WMI with Sysmon

For of all sad words of tongue or pen, the saddest are these: 'We weren’t logging’

Experimenting with Windows Security: Controls for Enforcing Policies

Sysmon Event IDs 1, 6, 7 Report All the Binary Code Executing on Your Network

Yet Another Ransomware Can That Can be Immediately Detected with Process Tracking on Workstations

Cracking AD Passwords with NTDSXtract, Dsusers.py and John the Ripper

Cracking local windows passwords with Mimikatz, LSA dump and Hashcat

Top Resources

Security Log

Additional Resources

May, 2024: Patch Tuesday - A few zero days and a fix introduced by last months patches

Welcome to my May Patch Tuesday newsletter. This month is fairly normal with only 91 patches being relased. Of the 91, we have three that we want to bring attention to. First is CVE-2024-30051 which is both public and being exploited. If sucessful, an attacker would gain SYSTEM privileges. This is most likely a widespread vulnerability being used in conjuction with Qakbot and other malwares. So get this updated ASAP. Next is CVE-2024-30040 which is not yet public but has been detected as exploited in the wild. An attacker would have to get a user to open a specially crafted file to be sucessful with this exploit. As history has shown us, this is not always a hard thing to do. So I suggest you get this tested and updated ASAP. Finally we have CVE-2024-30046. This exploit has a fairly low CVSS score and is rated by Microsoft as "Exploitation less likely". So get this update tested and pushed out when you can.

Also, have you had users having issues with VPN disconnections since last month? If so, this is probably related to a regression bug introduced in April's updates. Microsoft reports that KB5036893, which was part of the April 2024 security updates, introduced an issue with devices having VPN disconnection failures. That's the bad news. The good news is that KB5037771, which is part of this month's updates, does resolve the issue.

Patch data provided by:
Technology	Products Affected	Severity	Reference	Workaround/ Exploited / Publicly Disclosed	Vulnerability Info
Windows	Windows 10, 11 Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022 including Server Core Installations	Important	CVE-2024-26238 CVE-2024-29994 CVE-2024-29996 CVE-2024-29997 CVE-2024-29998 CVE-2024-29999 CVE-2024-30000 CVE-2024-30001 CVE-2024-30002 CVE-2024-30003 CVE-2024-30004 CVE-2024-30005 CVE-2024-30006 CVE-2024-30007 CVE-2024-30008 CVE-2024-30009 CVE-2024-30010 CVE-2024-30011 CVE-2024-30012 CVE-2024-30014 CVE-2024-30015 CVE-2024-30016 CVE-2024-30017 CVE-2024-30018 CVE-2024-30019 CVE-2024-30020 CVE-2024-30021 CVE-2024-30022 CVE-2024-30023 CVE-2024-30024 CVE-2024-30025 CVE-2024-30027 CVE-2024-30028 CVE-2024-30029 CVE-2024-30030 CVE-2024-30031 CVE-2024-30032 CVE-2024-30033 CVE-2024-30034 CVE-2024-30035 CVE-2024-30036 CVE-2024-30037 CVE-2024-30038 CVE-2024-30039 CVE-2024-30040 CVE-2024-30049 CVE-2024-30050 CVE-2024-30051	Workaround: No Exploited: Yes Public: Yes	Denial of Service Elevation of Privilege Information Disclosure Remote Code Execution Security Feature Bypass
Edge	Chromium-based	Low	CVE-2024-29986 CVE-2024-29987 CVE-2024-29991 CVE-2024-30055 CVE-2024-3157 CVE-2024-3515 CVE-2024-3516 CVE-2024-3832 CVE-2024-3833 CVE-2024-3834 CVE-2024-3837 CVE-2024-3838 CVE-2024-3839 CVE-2024-3840 CVE-2024-3841 CVE-2024-3843 CVE-2024-3844 CVE-2024-3845 CVE-2024-3846 CVE-2024-3847 CVE-2024-3914 CVE-2024-4058 CVE-2024-4059 CVE-2024-4060 CVE-2024-4331 CVE-2024-4368 CVE-2024-4558 CVE-2024-4559 CVE-2024-4671	Workaround: No Exploited: No Public: No	Information Disclosure Security Feature Bypass Spoofing
Office and SharePoint	365 Apps for Enterprise Excel 2016 Office 2019, LTSC 2021 LTSC for Mac 2021 SharePoint Enterprise Server 2016 SharePoint Server 2019 SharePoint Server Subscription Edition Office Online Server	Critical	CVE-2024-30042 CVE-2024-30043 CVE-2024-30044	Workaround: No Exploited: No Public: No	Informatio Disclosure Remote Code Execution
SQL Server	PowerBI-client JS SDK	Important	CVE-2024-30054	Workaround: No Exploited: No Public: No	Information Disclosure
Developer Tools	.NET 7.0, 8.0	Important	CVE-2024-30045	Workaround: No Exploited: No Public: No	Remote Code Execution
Visual Studio	2017 15.8 - 15.0 2019 16.11 - 16.0 2022 17.4, 17.6, 17.8, 17.9	Important	CVE-2024-30045 CVE-2024-30046 CVE-2024-32002 CVE-2024-32004	Workaround: No Exploited: No Public: Yes	Denial of Service Remote Code Execution
Apps	Bing Search for iOS Intune Mobile Application Management for Android	Important	CVE-2024-30041 CVE-2024-30059	Workaround: No Exploited: No Public: No	Spoofing Tampering
Azure	Migrate	Important	CVE-2024-30053	Workaround: No Exploited: No Public: No	Spoofing
Dynamics	365 Customer Insights	Important	CVE-2024-30047 CVE-2024-30048	Workaround: No Exploited: No Public: No	Spoofing

Send me this chart next Patch Tuesday.

User name:
Password:
	/ Forgot?
	Register

May 2024 Patch Tuesday	"Patch Tuesday - A few zero days and a fix introduced by last months patches " - sponsored by LOGbinder

Follow @randyfsmith

About | Newsletter | Contact

Ultimate IT Security is a division of Monterey Technology Group, Inc. ©2006-2024 Monterey Technology Group, Inc. All rights reserved.
Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. For complaints, please contact abuse@ultimatewindowssecurity.com.