Microsoft’s October 2024 Patch Tuesday: Five Zero-Day Vulnerabilities Fixed, Including Actively Exploited Flaws

Microsoft’s October 2024 Patch Tuesday release addresses 118 security vulnerabilities, including five zero-day vulnerabilities. These zero-days impact various components, from MSHTML to Microsoft Management Console (MMC), and pose significant risks to enterprises and individual users alike. Notably, two of these zero-day vulnerabilities are actively exploited in the wild, underlining the urgency for organisations to apply patches promptly.

Breakdown of the Five Zero-Day Vulnerabilities

1. CVE-2024-43573 – MSHTML Spoofing Vulnerability
   • Description: This vulnerability in MSHTML allows an attacker to spoof content and manipulate the visual appearance of web content. Attackers may exploit this flaw by convincing users to open malicious links or documents, leading to spoofed content that misleads or deceives.
   • Impact: Since MSHTML is used widely across Microsoft Office and Internet Explorer, the vulnerability has broad implications for systems that rely on these services.
   • Exploitation Status: Actively exploited in the wild, making this a critical vulnerability to patch immediately.
   • Microsoft Details | NVD
2. CVE-2024-43572 – Microsoft Management Console (MMC) Remote Code Execution (RCE)
   • Description: This RCE vulnerability in MMC allows attackers to execute arbitrary code on the target system by crafting a malicious file that the user opens with MMC. Given the common usage of MMC for administrative tasks, this could allow an attacker to gain significant control over affected systems.
   • Impact: Successful exploitation could enable an attacker to perform various actions, including the installation of programs, viewing and altering data, and creating new user accounts with full user rights.
   • Exploitation Status: Actively exploited in the wild, adding urgency to its remediation.
   • Microsoft Details | NVD
3. CVE-2024-6197 – libcurl Remote Code Execution (RCE)
   • Description: This vulnerability affects libcurl, a widely used client-side URL transfer library. An attacker could exploit this flaw by convincing a user to visit a specially crafted website, leading to code execution on the targeted machine.
   • Impact: With libcurl embedded in numerous applications, the reach of this vulnerability is potentially broad. Exploitation could lead to full system compromise depending on the privileges of the user running the application.
   • Exploitation Status: No active exploits reported.
   • Microsoft Details | NVD
4. CVE-2024-20659 – Hyper-V Security Bypass
   • Description: This vulnerability impacts Microsoft Hyper-V, enabling an attacker to bypass security restrictions within the virtualisation platform. It could allow unauthorised access to sensitive data or unauthorised escalation of privileges within virtual machines.
   • Impact: Although not actively exploited, this vulnerability represents a significant risk to environments using Hyper-V for virtualised workloads, especially those housing sensitive information.
   • Exploitation Status: No active exploits reported.
   • Microsoft Details | NVD
5. CVE-2024-43583 – Winlogon Elevation of Privilege
   • Description: This vulnerability in Winlogon allows an attacker to elevate privileges, potentially gaining unauthorised administrative access. Given Winlogon’s role in handling user logins, this flaw could enable a broad range of malicious activities on compromised systems.
   • Impact: While no proof-of-concept (PoC) is currently available, the potential impact on user credentials and system integrity makes this vulnerability critical for systems using Winlogon.
   • Exploitation Status: No active exploits reported.
   • Microsoft Details | NVD

At present, no publicly documented proof-of-concept (PoC) exploits are available for these zero-day vulnerabilities. However, due to the active exploitation of CVE-2024-43573 and CVE-2024-43572, Microsoft urges immediate application of the October security patches. For organisations with strict patch management procedures, it is advised to prioritise these actively exploited vulnerabilities.

For detection, it is recommended to monitor for suspicious activity in network logs, especially unusual access patterns involving MSHTML and MMC components. Enhanced monitoring on systems leveraging these components could provide early indicators of exploitation attempts.

Microsoft’s October 2024 Patch Tuesday release highlights the ongoing risks posed by zero-day vulnerabilities. With active exploitation in the wild for two of the patched flaws, it is essential that organisations remain vigilant and apply patches promptly to minimise exposure.

Further Reading

• Microsoft Patch Tuesday October 2024 Update Guide
• NVD – CVE-2024-43573 Details
• NVD – CVE-2024-43572 Details
• BleepingComputer’s October 2024 Patch Tuesday Overview