Patch Tuesday - June 2024

最后更新于2024年6月14日星期五14:15:18 GMT

这是 June 2024 Patch Tuesday. 微软今天正在解决51个漏洞, 而且有证据表明其中只有一项是公开披露的. At time of writing, none of the vulnerabilities published today are listed on 中钢协KEV，尽管这总是会发生变化. Microsoft is patching a single critical remote code execution (RCE) vulnerability today. 本月分别发布了7个浏览器漏洞, 和 are not included in the total.

MSMQ: critical RCE

The sole critical RCE patched today is CVE-2024-30080 for all current versions of Windows. Exploitation requires that an attacker send a specially crafted malicious packet to an MSMQ server, which Patch Tuesday watchers will know as a perennial source of vulnerabilities. As usual, Microsoft points out that the Windows message queuing service is not enabled by default; as usual, Rapid7 笔记 that a number of applications – including Microsoft Exchange – quietly introduce MSMQ as part of their own installation routine. 这是典型的MSMQ RCE漏洞, CVE-2024-30080 receives a high CVSSv3 base score due to the network attack vector, low attack complexity, 和 lack of required privileges. Code execution is presumably in a SYSTEM context, although the advisory does not specify.

Office: malicious file RCEs

Microsoft Office receives patches for a pair of RCE-via-malicious-file vulnerabilities. CVE-2024-30101 is a vulnerability in Outlook; although the Preview Pane is a vector, the user must subsequently perform unspecified specific actions to trigger the vulnerability 和 the attacker must win a race condition. On the other h和, CVE-2024-30104 没有预览窗格作为矢量, 但最终与稍高的CVSS基础得分7.8，因为利用完全依赖于用户打开一个恶意文件.

SharePoint: RCE

这个月还发布了SharePoint RCE的补丁 CVE-2024-30100. The advisory is sparing on details, 和 the context of code exploitation is not clear. The weakness is described as CWE-426: Untrusted 搜索 Path; many (but not all) vulnerabilities associated with CWE-426 lead to elevation of privilege.

DNSSEC NSEC3: CPU exhaustion DoS

现在是完全不同的东西: ​​CVE-2023-50868，描述了DNSSEC中的拒绝服务漏洞. 此漏洞存在于DNSSEC规范本身中, CVE由MITRE代表DNSSEC指定. Microsoft’s implementation of DNSSEC is thus subject to the same attack as other implementations. An attacker can exhaust CPU resources on a DNSSEC-validating DNS resolver by dem和ing responses from a DNSSEC-signed zone, 如果解析器使用NSEC3来响应请求. NSEC3 is designed to provide a safe way for a DNSSEC-validating DNS resolver to indicate that a requested resource does not exist. Under certain circumstances, the DNS resolver must perform thous和s of iterations of a hash function to calculate an NSEC3 response, 这就是DoS漏洞的基础. 所有当前版本的Windows Server今天都会收到补丁.

Typically, when Microsoft publishes a security advisory 和 describes the vulnerability as publicly disclosed, 公开披露将是最近的事. 然而, in the case of CVE-2023-50868, DNSSEC的漏洞是在2024-02-13首次公开披露的. The advisory acknowledges four academics from the German National Research Centre for Applied Cybersecurity (ATHENE), which is perhaps of interest since these same researchers are authors on a March 2024 academic paper that downplays the DoS potential of CVE-2023-50868. 这些研究人员公布了另一个DNSSEC漏洞 CVE-2023-50387 (也被称为KeyTrap)在2024年1月, which they describe as having potentially serious implications; Microsoft patched that one at the next scheduled opportunity in February. The CVE-2023-50868 advisory published today does not provide further insight as to why this vulnerability wasn’t patched sooner; a reasonable assumption might be that Microsoft assesses CVE-2023-50868 as less urgent/critical than CVE-2023-50387, although both receive a rating of Important on Microsoft’s proprietary severity ranking scale. 这是 also possible that Microsoft does not wish to be the only major server OS vendor without a patch.

Lifecycle update

There are no significant changes to the lifecycle phase of Microsoft products this month. 今年7月，微软SQL Server 2014将会发布 move past the end of extended support. From August onwards, Microsoft only guarantees to provide SQL Server 2014 security updates to customers who choose to participate in the paid Extended Security 更新 program.

Summary Charts

Summary Tables

Azure vulnerabilities

Browser vulnerabilities

Developer Tools vulnerabilities

ESU vulnerabilities

Microsoft Dynamics vulnerabilities

Microsoft Office vulnerabilities

Windows vulnerabilities

Windows ESU vulnerabilities

更新

• 2024-06-12修正了参考CVE-2023-50868时的一个错别字.