Microsoft has rolled out a series of patches to tackle 73 security flaws across its software lineup as part of the February 2024 security updates. These updates include fixes for two zero-day vulnerabilities that are already being actively exploited.
Of the 73 vulnerabilities addressed, 5 have been classified as critical, 65 as important, and three with moderate severity. These fixes add to the 24 issues previously resolved in the Chromium-based Edge browser during the January 24 updates.
The two vulnerabilities standing out as actively exploited at the time of patch release are as follows:
CVE-2024-21351 (CVSS Score: 7.6) - Windows SmartScreen Security Feature Bypass Vulnerability
This vulnerability allows a malicious actor to inject code into SmartScreen, potentially achieving code execution. Successful exploitation could lead to data exposure or system unavailability. For the attack to work, the threat actor must persuade the user to open a malicious file.
CVE-2024-21412 (CVSS Score: 8.1) - Internet Shortcut Files Security Bypass Vulnerability
This flaw enables an attacker to bypass security controls by sending a specially crafted file to a target user. Exploiting this vulnerability may compromise system security, but the attacker cannot force the user to view the content controlled by them.
Both these vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), urging federal agencies to apply the updates by March 5, 2024.
In addition to these two vulnerabilities, Microsoft has also patched five critical flaws, including:
CVE-2024-20684 (CVSS: 6.5) - Denial of Service Vulnerability in Windows Hyper-V
CVE-2024-21357 (CVSS: 7.5) - Remote Code Execution Vulnerability in Windows Pragmatic General Multicast (PGM)
CVE-2024-21380 (CVSS: 8.0) - Information Disclosure Vulnerability in Microsoft Dynamics Business Central/NAV
CVE-2024-21410 (CVSS: 9.8) - Privilege Elevation Vulnerability in Microsoft Exchange Server
CVE-2024-21413 (CVSS: 9.8) - Remote Code Execution Vulnerability in Microsoft Outlook
Apart from Microsoft, other vendors have also released security updates to address various vulnerabilities in recent weeks. These include Adobe, AMD, Android, ASUS, Cisco, Dell, Drupal, F5, Google Chrome, IBM, Intel, NVIDIA, SAP, Siemens, WordPress, and many others. Users are advised to apply these updates to ensure the security of their systems.
.
.
.
.
.
Report any cyber incident to our Security Incident Response Team (CSIRT) now. Together, we can strengthen our defenses and maintain a safe digital environment for everyone.
Don't underestimate the importance of your contribution. Your information is crucial to identifying and neutralizing threats. Click the link below to report any incidents: https://bit.ly/ReportACyberProblem
Remember, security is a collective effort. Thank you for being part of our team of digital advocates!