Microsoft’s July Security Update Fixes 143 Vulnerabilities, Including Two Critical Exploits

Microsoft has rolled out its latest set of monthly security updates, addressing a total of 143 vulnerabilities. Among these, two have already been exploited in the wild, underscoring the urgency for users to apply these patches.

Critical and Important Fixes

Of the 143 vulnerabilities patched, five are classified as Critical, 136 as Important, and four as Moderate in severity. Additionally, Microsoft has also resolved 33 vulnerabilities in its Chromium-based Edge browser over the past month.

Actively Exploited Vulnerabilities

The two flaws currently being exploited are:

• CVE-2024-38080 (CVSS score: 7.8): A Windows Hyper-V Elevation of Privilege Vulnerability.
• CVE-2024-38112 (CVSS score: 7.5): A Windows MSHTML Platform Spoofing Vulnerability.

CVE-2024-38112: MSHTML Platform Spoofing

According to Microsoft, exploiting CVE-2024-38112 requires an attacker to take specific preparatory actions, such as sending the victim a malicious file to execute. Check Point security researcher Haifei Li, who discovered and reported the flaw in May 2024, explained that attackers use specially-crafted Windows Internet Shortcut files (.URL). These files, when clicked, redirect victims to a malicious URL via the now-retired Internet Explorer (IE) browser.

“An additional trick on IE is used to hide the malicious .HTA extension name,” Li noted. “By opening the URL with IE instead of the more secure Chrome/Edge browser, attackers gain significant advantages in exploiting the victim’s computer, even on modern Windows 10/11 systems.”

Evidence of this attack technique dates back to January 2023, with samples uploaded to the VirusTotal malware scanning platform, indicating that threat actors have been aware of this loophole for over a year and a half.

CVE-2024-38080: Windows Hyper-V Elevation of Privilege

Tenable’s senior staff research engineer, Satnam Narang, highlighted the severity of CVE-2024-38080, an elevation of privilege flaw in Windows Hyper-V. “A local, authenticated attacker could exploit this vulnerability to elevate privileges to SYSTEM level following an initial compromise,” Narang explained. This is the first Hyper-V flaw to be exploited in the wild since 2022.

Publicly Known Vulnerabilities

Two other vulnerabilities patched by Microsoft were publicly known at the time of release:

• CVE-2024-37985 (CVSS score: 5.9): A side-channel attack called FetchBench that could enable an adversary to view heap memory from a privileged process on Arm-based systems.
• CVE-2024-35264 (CVSS score: 8.1): A remote code execution bug affecting .NET and Visual Studio. This flaw could be exploited by closing an HTTP/3 stream while the request body is being processed, leading to a race condition and potential remote code execution.

Additional Security Updates

The Patch Tuesday updates also include fixes for a variety of vulnerabilities:

• 37 remote code execution flaws in the SQL Server Native Client OLE DB Provider.
• 20 Secure Boot security feature bypass vulnerabilities.
• Three PowerShell privilege escalation bugs.
• A spoofing vulnerability in the RADIUS protocol, CVE-2024-3596, also known as BlastRADIUS.

Greg Wiseman, Rapid7’s Lead Product Manager, emphasized the importance of updating not only SQL Server instances but also client code running vulnerable versions of the OLE DB Provider. “An attacker could use social engineering to trick an authenticated user into connecting to a malicious SQL Server database, allowing arbitrary code execution on the client,” Wiseman warned.