Microsoft’s final Patch Tuesday updates for 2024 addressed a total of 72 security flaws across its software range, with one flaw being actively exploited in the wild. Among these vulnerabilities, 17 were rated Critical, 54 were Important, and one was Moderate. The vulnerabilities included remote code execution flaws and elevation of privileges.
One of the vulnerabilities, CVE-2024-49138, a privilege escalation flaw in the Windows Common Log File System (CLFS) Driver, was actively exploited. Microsoft credited cybersecurity company CrowdStrike for discovering and reporting the flaw. This is the fifth actively exploited CLFS privilege escalation flaw since 2022, highlighting the appeal of this attack pathway for malicious actors.
Microsoft has acknowledged the attractiveness of CLFS as an attack vector and is working on adding new verification steps to enhance security. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the actively exploited vulnerability to its Known Exploited Vulnerabilities catalog, mandating remediations by the end of the year.
In addition to Microsoft’s patches, other vendors have also released security updates to address vulnerabilities. The landscape of cyber threats continues to evolve, with attackers targeting legacy protocols like NTLM. Microsoft is taking steps to deprecate NTLM in favor of more secure authentication methods, such as Kerberos, to bolster security and protect users from real-world attacks.
Overall, the cybersecurity community remains vigilant in addressing vulnerabilities and enhancing security measures to mitigate cyber threats and protect digital assets. As the threat landscape evolves, proactive security measures and timely patching are crucial to safeguarding systems and data from malicious actors.
Source link