Microsoft Security Update : RCE, Privilege Escalation Flaws Patched

The June 2024 Patch Tuesday update from Microsoft addressed almost 49 vulnerabilities in its merchandise and 9 vulnerabilities in non-Microsoft merchandise.

The update encompasses a significant vulnerability in Microsoft Message Queuing (MSMQ) that permits a ways-off code execution to be tracked as CVE-2024-30080.

Yet every other vulnerability in Windows Server and non-Microsoft tool that’s publicly identified nevertheless has no longer but been publicly exploited is tracked as CVE-2023-50868.

Serious Vulnerability Addressed

With a CVSS rating of 9.8, the significant vulnerability is tracked as CVE-2024-30080. An attacker must ship a malicious MSMQ packet that has been particularly constructed to an MSMQ server to take income of this flaw.

On the server extinguish, this would well result in a ways-off code execution. All Windows variations, starting with Windows Server 2008 and Windows 10, are impacted by this relate.

The Windows message queuing service, a Windows relate, wants to be enabled as a mitigating mechanism before this vulnerability can compromise a system. The utilization of the Adjust Panel, this characteristic will seemingly be incorporated.

It is doubtless you’ll well maybe per chance search whether the machine has a service named Message Queuing working and TCP port 1801 open for listeners.

Necessary RCE And Privilege Escalation Flaws Addressed

This update contains significant a ways-off code execution vulnerabilities, which contains CVE-2024-30103 in Microsoft Outlook, the place an attacker could furthermore enable the advance of malicious DLL files and bypass Outlook registry block lists;

CVE-2024-30078 within the Windows Wi-Fi Driver the place an unauthorized attacker would possibly per chance ship a malicious networking packet to a shut-by system the utilize of a Wi-Fi networking adaptor, making an allowance for a ways-off code execution.

CVE-2024-30089 is an elevated privilege vulnerability in Microsoft Streaming Service. An attacker who successfully exploits this vulnerability would possibly per chance put SYSTEM privileges.

CVE-2024-30085 is within the Windows Cloud Files Mini Filter Driver, the place an attacker who successfully exploits this vulnerability would possibly per chance put SYSTEM privileges.

A significant vulnerability in Win32k (CVE-2024-30082) finally ends up in an Elevation of Privilege Vulnerability, the place an attacker who successfully exploited this vulnerability would possibly per chance put SYSTEM privileges.

Publicly Identified Vulnerability Addressed

In Windows Server, a publicly identified vulnerability identified as CVE-2023-50868 has no longer but been publicly exploited.

CVE-2023-50868 is a vulnerability connected to DNSSEC validation. By racy excessive resources on a resolver, an attacker would possibly per chance take income of typical DNSSEC protocols intended for DNS integrity and sing service to legit users.

Microsoft has printed a full list of patched vulnerabilities, which provides detailed recordsdata about the exploitation ideas, vulnerability descriptions, and other recordsdata.

All users must update their merchandise to the most fresh model to extinguish chance actors from exploiting these vulnerabilities.