On Patch Tuesday on April 9, 2024, Microsoft supplied a number of safety updates to repair 147 vulnerabilities. Microsoft classifies three vulnerabilities in Microsoft Defender for IoT as crucial and classifies all however two of the opposite vulnerabilities as excessive threat. According to Microsoft, not one of the vulnerabilities have been exploited for assaults thus far. However, this might change at any time. Trend Micro has additionally noticed ZDI exploit code within the wild.

Microsoft provides sparse particulars on the vulnerabilities for self-searching in its security update guide. Dustin Childs presents the subject of Update Tuesday rather more clearly within the Trend Micro ZDI blog – all the time with a watch on admins who handle company networks. According to Dustin Childs, he doesn’t keep in mind Microsoft ever patching as many safety vulnerabilities in a single month because it did this April.

The giant variety of vulnerabilities patched in April is due not least to a variety of RCE (Remote Code Execution) vulnerabilities within the OLE DB driver for SQL Server (38), DHCP and DNS servers (9) and SFB vulnerabilities in Secure Boot (24). Although the updates for Secure Boot repair the errors, they nonetheless must be activated with additional steps (KB5025885).

Browser updates

The newest safety replace for Edge is model 123.0.2420.81 from 4 April. It relies on Chromium 123.0.6312.106 and fixes a number of vulnerabilities within the Chromium base. The Microsoft builders have additionally mounted two Edge-specific safety vulnerabilities.

Office vulnerabilities

Microsoft has closed two gaps within the merchandise of its Office household, each of that are labelled as excessive threat. These embody CVE-2024-26257, an RCE vulnerability in Excel. This impacts Microsoft 365 Apps for Business and Office LTSC for Mac 2021 – Office for Mac historically receives safety updates with some delay. The second vulnerability is a spoofing vulnerability (CVE-2024-26251) in Sharepoint Server. In addition, CVE-2024-20670 is a spoofing vulnerability in Outlook for Windows.

Vulnerabilities in Windows

The majority of the vulnerabilities, 91 this time, are unfold throughout the varied Windows variations (10 and newer in addition to Server) for which Microsoft nonetheless provides safety updates for all. Although Windows 7 and eight.1 are now not talked about within the safety reviews, they may nonetheless be weak. If the system necessities permit it, you must change to Windows 10 (22H2) or Windows 11 to proceed receiving safety updates.

0-day exploit in Windows or not?

In Microsoft’s data on the present Update Tuesday, there isn’t any indication that any of the patched vulnerabilities are already being utilized in assaults or that exploit code for any of the vulnerabilities is in circulation. However, Dustin Childs notes within the ZDI weblog that exploits for a vulnerability found by his colleague Peter Girrus have certainly been noticed within the wild.

This issues the SFB (Security Feature Bypass) vulnerability CVE-2024-29988 within the Smart Screen Filter. It is much like the vulnerability CVE-2024-21412 from February, which was exploited by the APT group Water Hydra (often known as Dark Casino) to inject malware. Exploitation of such a vulnerability implies that Windows Defender doesn’t mark a file downloaded from the Internet with the “Mark-of-the-Web” (MotW) attribute and subsequently doesn’t warn in opposition to opening the (probably unsafe) file. This is subsequently referred to as a safety characteristic bypass.

Critical IoT vulnerabilities

Microsoft solely classifies three RCE vulnerabilities in Microsoft Defender for IoT (Internet of Things or Smart Home) as crucial. These are supplemented by three EoP (Elevation of Privilege) vulnerabilities. It stays unclear how doubtless such an assault is at this level. However, you must take each attainable assault in your traces of protection significantly.

Further studying: The best antivirus software we’ve tested

This article was translated from German to English and initially appeared on pcwelt.de.