Patch Tuesday Italia Luglio

Presentato da Roberta Baudo e Nicola Del Giudice
Patch Tuesday Webinar
Giovedì 11 Luglio 2024

Copyright © 2024 Ivanti. All rights reserved. 2
Agenda
§ July 2024 Patch Tuesday Overview
§ In the News
§ Bulletins and Releases
§ Between Patch Tuesdays
§ Q & A

Microsoft has resolved a total of 142 unique CVEs this
month including two Zero-day vulnerabilities (CVE-
2024-38112 and CVE-2024-38080) and two publicly
disclosed vulnerabilities (CVE-2024-37985 and CVE-
2024-35264). The two Zero-days and one of the public
disclosures are in the Windows OS making that your
top priority this month. Last, but not least, don't forget
your browsers. Mozilla Firefox, Google Chrome, and
Edge will all be in need of updates.
For more details check out this month's Patch Tuesday
blog.
July Patch Tuesday 2024

In the News

In the News
§ Delay in Recall feature
§ https://www.bleepingcomputer.com/news/microsoft/microsoft-delays-windows-recall-amid-privacy-and-security-
concerns/
§ Preview in Action
§ https://www.bleepingcomputer.com/news/microsoft/microsoft-resumes-rollout-of-windows-11-kb5039302-
update-for-most-users/
§ New Vulnerability Exploits
§ https://www.darkreading.com/cyberattacks-data-breaches/moveit-transfer-flaws-security-defense-attackers
§ Attackers Already Exploiting Flaws in Microsoft's July Security Update
§ https://www.darkreading.com/application-security/attackers-already-exploiting-flaws-in-microsofts-july-security-
update

§ CVE-2024-38112 Windows MSHTML Platform Spoofing Vulnerability
§ CVSS 3.1 Scores: 7.5 / 7.0
§ Severity: Important
§ Impact: Spoofing
§ Affected Systems: All currently supported versions of the Windows operating system
§ Per Microsoft: An attacker would have to send the victim a malicious file that the victim would have to
execute.
§ CVE-2024-38080 Windows Hyper-V Elevation of Privilege Vulnerability
§ CVSS 3.1 Scores: 7.8 / 6.8
§ Impact: Elevation of Privilege
§ Affected Systems: Windows 11 and Server 2022
§ Per Microsoft: An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Known Exploited Vulnerabilities

§ CVE-2024-35264 .NET and Visual Studio Remote Code Execution Vulnerability
§ CVSS 3.1 Scores: 8.1 / 7.1
§ Impact: Remote Code Execution
§ Affected Systems: .NET 8.0 and Visual Studio 2022 v17.4 – 17.10
§ Per Microsoft: An attacker could exploit this by closing an http/3 stream while the request body is being
processed leading to a race condition. This could result in remote code execution.
§ ARM CVE-2024-37985 Systematic Identification and Characterization of Proprietary Prefetchers
§ CVSS 3.1 Scores: 5.8 / 5.2
§ Impact: Information Disclosure
§ Affected Systems: Windows 11 22H2 and 23H2 ARMx64 systems
§ Per Microsoft: An attacker who successfully exploited this vulnerability could view heap memory from a
privileged process running on the server.
Publicly Disclosed Vulnerabilities

CVE-2024-6387
§ CVSS 3: 8.1
§ A flaw in OpenSSH versions ( <4.4 and between 8.5
an 9.8 ) allows a remote attacker to cause the sshd
service to crash and execute attacker-controlled
code, by letting connection attempts reach the
timeout period (120s by default).
§ This can be used to obtain root-level shell access
remotely, but it can take 8 hours to a week to
exploit. Exploit depends on crashing ssh on a
particular part of the sshd code, which can take
multiple attempts.
§ This flaw resurfaced in the openssh code after
being reintroduced in 2020. It had been present in
the code, and fixed, circa 2006.
Impact
There are several million internet-facing ssh servers
potentially vulnerable, but the length of the attack
makes a widespread exploit unlikely – though it
could be used in targeted attacks.
Mitigation
Updating to the latest OpenSSH version is the best
alternative. Removing ssh from Internet-facing
systems (and use a VPN prior to connecting) is the
best practice.
New and Notable Linux Vulnerabilities: 1
Highlighted by TuxCare

CVE-2024-22211
CVSS 3: 9.8
§ FreeRDP is a set of Remote Desktop-compatible
client and server implementations for Linux-
based systems.
§ Versions prior to 2.11.5 (on the 2.x series) and
3.2.0 (on the 3.x series) of the client
implementation can be tricked by a malicious
server into crashing and potentially leveraged for
other purposes (so far, not disclosed).
Importance
This vulnerability is relevant because it affects
CentOS 7, which went past the End-of-Life date at
the end of June, and as such, will have no updates
forthcoming.
Mitigation
Compiling your own secure version, or obtaining an
updated package from an extended support vendor
is the only available option.

CVE-2024-2961
§ CVSS 3: 8.8
§ Iconv, a function used to convert text between
different encodings and included in glibc, has
been found to overflow a buffer when converting
strings to ISO-2022-CN-EXT character set.
§ This may be used to crash applications relying
on iconv (of which there are plenty) and be used
as a denial-of-service against specific vulnerable
applications and services.
Impact
Affects glibc up to version 2.39.
Mitigation
Updating past this version is advised. Impacts
Enterprise Linux versions 6, 7, 8 and 9, and Ubuntu
16.04 and 18.04.

Microsoft Patch Tuesday Updates of Interest
Advisory 990001
Latest Servicing Stack Updates (SSU)
§ https://msrc.microsoft.com/update-
guide/en-US/vulnerability/ADV990001
§ Server 2012/2012 R2 ESU and Windows
10 (see graphic)
Azure and Development Tool Updates
§ .NET 8
§ Azure CycleCloud 7.9.2 – 8.5.0
§ Azure Network Watcher VM Extension
§ Visual Studio 2022 v17.4 – v17.10
Source: Microsoft

Windows 10
and 11 Lifecycle
Awareness
Windows 10 Enterprise and Education
Version Release Date End of Support Date
22H2 10/18/2022 10/14/2025
Windows 10 Home and Pro
22H2 10/18/2022 10/14/2025
Windows 11 Home and Pro
23H2 10/31/2023 11/11/2025
22H2 9/20/2022 10/8/2024
Windows 11 Enterprise and Education
23H2 10/31/2023 11/10/2026
22H2 9/20/2022 10/14/2025
21H2 10/4/2021 10/8/2024
Source: Microsoft
https://docs.microsoft.com/en-us/lifecycle/faq/windows

Server Long-term Servicing Channel Support
Server LTSC Support
Version Editions Release Date Mainstream Support Ends Extended Support Ends
Windows Server 2022 Datacenter and Standard 08/18/2021 10/13/2026 10/14/2031
Windows Server 2019
(Version 1809)
Datacenter, Essentials, and Standard 11/13/2018 01/09/2024 01/09/2029
Windows Server 2016
(Version 1607)
Datacenter, Essentials, and Standard 10/15/2016 01/11/2022 01/11/2027
https://learn.microsoft.com/en-us/windows-server/get-started/windows-server-release-info
§ Focused on server long-term stability
§ Major version releases every 2-3 years
§ 5 years mainstream and 5 years extended support
§ Server core or server with desktop experience available
Source: Microsoft

Patch Content Announcements
Announcements Posted on Community Forum Pages
§ https://forums.ivanti.com/s/group/CollaborationGroup/00Ba0000009oKICEA2
§ Subscribe to receive email for the desired product(s)
Content Info: Endpoint Security
Content Info: Endpoint Manager
Content Info: macOS Updates
Content Info: Linux Updates
Content Info: Patch for Configuration Manager
Content Info: ISEC and Neurons Patch
Content Info: Neurons Patch for InTune

Bulletins and Releases

Copyright © 2024 Ivanti. All rights reserved.
MFSA-2024-29: Security Update Firefox 128
§ Maximum Severity: Important
§ Affected Products: Security Update Firefox
§ Description: This update from Mozilla addresses security vulnerabilities in the Firefox browser on
multiple platforms. Fixes 16 vulnerabilities; 4 are rated High.
§ Impact: Remote Code Execution, Denial of Service, Elevation of Privilege, Information
Disclosure
§ Fixes 16 Vulnerabilities: See the Mozilla Security Advisory https://www.mozilla.org/en-
US/security/advisories/mfsa2024-29/ for complete details.
§ Restart Required: Requires application restart
§ Known Issues: None
1
2

MFSA-2024-30: Security Update Firefox ESR 115.13
§ Affected Products: Security Update Firefox ESR
§ Description: This update from Mozilla addresses security vulnerabilities in the Firefox ESR
browser on multiple platforms. Fixes 5 vulnerabilities; 3 are rated High.
§ Impact: Remote Code Execution, Denial of Service, Information Disclosure
§ Fixes 5 Vulnerabilities: See the Mozilla Security Advisory https://www.mozilla.org/en-
US/security/advisories/mfsa2024-30/ for complete details.
§ Known Issues: None
1
2

MS24-07-W11: Windows 11 Update
§ Maximum Severity: Critical
§ Affected Products: Microsoft Windows 11 Version 21H2, 22H2, 23H2 and Edge Chromium
§ Description: This bulletin references KB 5040431 (21H2) and KB 5040442 (22H2/23H2). See
KBs for details of all changes.
§ Impact: Remote Code Execution, Security Feature Bypass, Denial of Service, Spoofing,
Elevation of Privilege, and Information Disclosure
§ Fixes 74 Vulnerabilities: CVE-2024-37985 is publicly disclosed, and CVE-2024-38080 and CVE-
2024-38112 are known exploited. See the Security Update Guide for the complete list of CVEs.
§ Restart Required: Requires restart
§ Known Issues: See next slide
1

July Known Issues for Windows 11
§ KB 5040431 – Windows 11 version 21H2, all editions
§ [Prof_Pic] After installing this update, you might be unable to change your user account
profile picture. When attempting to change a profile picture by selecting the button Start>
Settings> Accounts > Your info, and then selecting Choose a file, you might receive an error
message with error code 0x80070520. Workaround: Microsoft is working on a resolution
§ KB 5040442 – Windows 11 version 22H2 and 23H2, all editions
§ [Ent_Up] After installing this update or later updates, you might face issues while upgrading
from Windows Pro to a valid Windows Enterprise subscription.
Resulting from this operation, you might observe the following symptoms: - OS upgrade
operations may fail, and this might be shown in the LicenseAcquisition scheduled task in
Task Scheduler -> Task Scheduler Library -> Microsoft -> Windows -> Subscription as
‘Access denied error (error code 0x80070005)’ under ‘Last Run Result’
• Workaround: Microsoft is working on a resolution.

MS24-07-W10: Windows 10 Update
§ Affected Products: Microsoft Windows 10 Versions 1607, 1809, 22H2, Server 2016, Server
2019, Server 2022, Server 2022 Datacenter: Azure Edition and Edge Chromium
§ Description: This bulletin references 6 KB articles. See KBs for details of all changes.
§ Impact: Remote Code Execution, Security Feature Bypass, Denial of Service, Spoofing,
Elevation of Privilege, and Information Disclosure
§ Fixes 74 Vulnerabilities: CVE-2024-38080 and CVE-2024-38112 are known exploited. No CVEs
are reported publicly disclosed. See the Security Update Guide for the complete list of CVEs.
§ Known Issues: See next slide
1

July Known Issues for Windows 10
§ KB 5040430 – Win 10 Enterprise LTSC 2019, Win 10 IoT Enterprise LTSC 2019, Windows 10
IoT Core 2019 LTSC, Windows Server 2019
§ [Language Change] After installing KB5039217, released June 11, 2024, you might
observe a change in language for context menus and dialog buttons in Windows
applications. Parts of the UI might display in English when English is not set as the
Windows display language. In addition, font size might change for the names of tabs and
buttons
§ Workaround: Microsoft is working on a resolution.

July Known Issues for Windows 10 (cont)
§ KB 5040427 – Windows 10 Enterprise LTSC 2021, Windows 10 IoT Enterprise LTSC 2021,
Windows 10, version 22H2, all editions
§ [Cache] After you install KB5034203 (dated 01/23/2024) or later updates, some Windows
devices that use the DHCP Option 235 to discover Microsoft Connected Cache (MCC)
nodes in their network might be unable to use those nodes. Instead, these Windows
devices will download updates and apps from the public internet. Workaround: See KB for
configuration options.
§ [Prof_Pic]
§ Microsoft is working on a resolution for both issues.
§ KB 5040437 – Windows Server 2022
§ [Prof_Pic]

§ Affected Products: Microsoft SharePoint Server Subscription Edition, SharePoint Enterprise
Server 2016, and SharePoint Server 2019
§ Description: This security update resolves several Microsoft SharePoint Server remote code
execution and information disclosure vulnerabilities. This bulletin is based on KB 5002615
(2019), KB 5002606 (sub), and KB 5002618 (2016) articles.
§ Impact: Remote Code Execution, Information Disclosure
§ Fixes 4 Vulnerabilities: CVE-2024-32987, CVE-2024-38023, CVE-2024-38024, and CVE-2024-
38044. No CVEs are reported exploited or publicly disclosed.
§ Known Issues: None reported
MS24-07-SPT: Security Updates for Sharepoint Server
1

MS24-07-SQL: Security Updates for SQL Server
§ Affected Products: Microsoft SQL Server 2016 SP3 (GDR and Azure Connect Feature Pack),
Microsoft SQL Server 2017 (GDR and CU31), Microsoft SQL Server 2019 (GDR and CU27)
and Microsoft SQL Server 2022 (GDR and CU13)
§ Description: This security update fixes a series of Microsoft OLE DB Driver vulnerabilities which
could allow remote code execution. This bulletin is based on 8 KB articles.
§ Impact: Remote Code Execution
§ Fixes 38 Vulnerabilities: No CVEs are known exploited or publicly disclosed. See the Security
Update Guide for the complete list of CVEs.
2

§ Affected Products: Office Professional Plus 2016 Office Professional 2016 Office Standard 2016
Office Home and Business 2016 Office Home and Student 2016
§ Description: This security update resolves remote code execution and a spoofing vulnerability in
Microsoft Outlook. Neither can be exploited via the Preview Pane. This bulletin references KBs
5002620 and 5002621.
§ Impact: Remote Code Execution, Spoofing
§ Fixes 2 Vulnerabilities: CVE-2024-38020 and CVE-2024-38021 are not known to be exploited or
publicly disclosed.
MS24-07-OFF: Security Updates for Microsoft Office
1
2

§ Affected Products: Microsoft 365 Apps, Office 2019, and Office LTSC 2021
§ Description: This security update resolves remote code execution and a spoofing vulnerability in
Microsoft Outlook. Neither can be exploited via the Preview Pane. Information on the security
updates is available at
https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates.
§ Impact: Remote Code Execution, Spoofing
§ Fixes 2 Vulnerabilities: CVE-2024-38020 and CVE-2024-38021 are not known to be exploited or
publicly disclosed.
MS24-07-O365: Security Updates for Microsoft 365 Apps
1
2

MS24-07-MRNET: Monthly Rollup for Microsoft .NET
1
2
§ Affected Products: Microsoft Windows .Net Framework 2.0 SP2 through 4.8.1
§ Description: This update fixes a vulnerability in the .NET framework whereby an attacker who
successfully exploited this vulnerability could gain SYSTEM privileges. This bulletin references
14 KB articles.
§ Fixes 1 Vulnerability: CVE-2024-38081
§ Restart Required: Does not require a system restart after you apply it unless files that are being
updated are locked or are being used.

MS24-07-SONET: Monthly Rollup for Microsoft .NET
2
§ Affected Products: Microsoft Windows .Net Framework 2.0 SP2 through 4.8.1
§ Description: This update fixes a vulnerability in the .NET framework whereby an attacker who
successfully exploited this vulnerability could gain SYSTEM privileges. This bulletin references
14 KB articles.
§ Restart Required: Does not require a system restart after you apply it unless files that are being
updated are locked or are being used.

Between
Patch Tuesdays

Windows Release Summary
§ Security Updates (with CVEs): AutoCAD (1), Google Chrome (2), Ivanti Pulse Secure VPN Desktop
Client (1), Apache Tomcat (2)
§ Security Updates (w/o CVEs): Adobe Acrobat DC and Acrobat Reader DC (2), CCleaner (2), Cisco
Webex Meetings Desktop App (1), Falcon Sensor for Windows (1), Docker For Windows (1), Dropbox
(1), Evernote (5), Firefox (2), Grammarly for Windows (3), HPE System Management Homepage (1),
Malwarebytes (1), Node.JS (Current) (1), Node.JS (LTS Upper) (1), Opera (3), Plex Media Server (1),
Recuva (1), Royal TS (2), Skype (2), Slack Machine-Wide Installer (2), Snagit (1), Splunk Universal
Forwarder (3), Tableau Desktop (7), Tableau Prep Builder (2), Tableau Reader (2), Thunderbird (2),
TeamViewer (1), WinSCP (1), Zoom Workplace Desktop App (2), Zoom Workplace VDI App (2)
§ Non-Security Updates: 7-Zip (1), Amazon WorkSpaces (2), BlueBeam Revu (1), Box Drive (1),
Bitwarden (4), Camtasia (2), Cisco Webex Teams (1), draw.io (2), Evernote (1), Google Drive File
Stream (1), GoodSync (2), GeoGebra Classic (1), GoTo Connect (1), Ivanti Security Console (1),
KeePassXC (1), LogMeIn (2), NextCloud Desktop Client (1), PDF-Xchange PRO (1), R for Windows
(1), RingCentral App (Machine-Wide Installer) (3), RealVNC Server (1), RealVNC Viewer (1),

Windows Third Party CVE Information
§ AutoCAD 2024.1.5
§ ADAC24-240625, QACAD202415
§ Fixes 13 Vulnerabilities: CVE-2024-23150, CVE-2024-23151, CVE-2024-23152, CVE-2024-23153,
CVE-2024-23154, CVE-2024-23155, CVE-2024-23156, CVE-2024-23157, CVE-2024-23158,
CVE-2024-23159, CVE-2024-36999, CVE-2024-37005, CVE-2024-37007
§ Google Chrome 126.0.6478.115
§ CHROME-240618, QGC12606478115
§ Fixes 4 Vulnerabilities: CVE-2024-6100, CVE-2024-6101, CVE-2024-6102, CVE-2024-6103
§ CHROME-240625, QGC12606478127

Windows Third Party CVE Information (cont)
§ Ivanti Pulse Secure VPN Desktop Client 22.7.1.1.29163
§ PSVPN-240625, QPSVPN227111
§ Fixes 2 Vulnerabilities: CVE-2023-38042, CVE-2023-46810
§ Apache Tomcat 10.1.25
§ TMCAT101-240621, QTOMCAT10125
§ Apache Tomcat 9.0.90
§ TMCAT90-240620, QTOMCAT9090

Apple Release Summary
§ Security Updates (with CVEs): Google Chrome (2), Microsoft Edge (2), Thunderbird (1)
§ Security Updates (w/o CVEs): Microsoft AutoUpdate (1), Zoom Client for Mac (1)
§ Non-Security Updates: 7-Zip (1), Brave (3), Docker Desktop for Mac (1), draw.io (2), Dropbox
(2), Evernote (5), Firefox (2), Google Drive (1), Grammarly (3), HandBrake (1), IntelliJ IDEA
(1), Microsoft Edge (2), Obsidian for Mac (1), OneDrive for Mac (1), Microsoft Office 2019
Outlook (3), Microsoft Teams (Mac) (2), Parallels Desktop (1), PyCharm Professional (1),
Python (1), Slack (1), Spotify (2), Thunderbird (1), Visual Studio Code (2), Webex Teams for
Mac (1), Zoom Client (1)

Apple Third Party CVE Information
§ CHROMEMAC-240620
§ CHROMEMAC-240625
§ Thunderbird 115.12.1
§ TB-240619
§ Fixes 8 Vulnerabilities: CVE-2024-5688, CVE-2024-5690, CVE-2024-5691, CVE-2024-5692, CVE-
2024-5693, CVE-2024-5696, CVE-2024-5700, CVE-2024-5702

Apple Third Party CVE Information (cont)
§ Microsoft Edge 126.0.2592.68
§ MEDGEMAC-240620
§ Fixes 6 Vulnerabilities: CVE-2024-38082, CVE-2024-38093, CVE-2024-6100, CVE-2024-
6101, CVE-2024-6102, CVE-2024-6103
§ Microsoft Edge 126.0.2592.81
§ MEDGEMAC-240627
§ Fixes 5 Vulnerabilities: CVE-2024-34122, CVE-2024-6290, CVE-2024-6291, CVE-2024-6292,
CVE-2024-6293

Q & A

Thank You!

Patch Tuesday Italia Luglio

More Related Content

Similar to Patch Tuesday Italia Luglio

More from Ivanti

Recently uploaded

Patch Tuesday Italia Luglio