Microsoft has released its first batch of security updates in 2024 addressing around 50 vulnerabilities impacting Microsoft products, including multiple remote code execution flaws.
One of the most notable flaws fixed as part of January 2024 Patch Tuesday is CVE-2024-20674, a security feature bypass issue that can allow a remote attacker to intercept a valid Kerberos authentication message from the authentication server and use it to impersonate the authentication server on the victim machine. While there’s no indication this vulnerability has been exploited in the wild, the exploitation is very likely following the public disclosure.
Besides the above-mentioned, Microsoft has fixed two bugs in the Windows Hyper-V subsystem (CVE-2024-20700 and CVE-2024-20699) that could allow to achieve remote code execution and perform a denial of service (DoS) attack, respectively.
This month’s Patch Tuesday also addresses a number of high-severity vulnerabilities affecting Microsoft NET, .NET Framework, and Visual Studio, Microsoft Printer Metadata Troubleshooter Tool, Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider, Microsoft Office.
Other important issues include bugs in Windows Nearby Sharing, MS Remote Desktop Client, Windows Cryptographic Services, SharePoint Server, and Windows TCP/IP.
