VERT Threat Alert: November 2024 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s November 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1132 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2024-43451

A vulnerability that allows for NTLMv2 hash disclosure has been both publicly disclosed and actively exploited. According to Microsoft, only minimal interaction is required and a user left or right clicking on a malicious file is enough to trigger this vulnerability. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-49039

Microsoft is reporting that a privilege escalation exists within Windows Task Scheduler that could allow a low privilege user to elevate their permissions to a Medium Integrity Level. For example, an attacker could escalate their permissions from a low privilege AppContainer to a higher integrity level and execute code. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-49040

A vulnerability in Microsoft Exchange Server allows non-RFC 5322 compliant P2 FROM headers to pass to the email client, which can allow the sender of an email to be spoofed. After installing the Exchange update, a new disclaimer will be prepended to the message body and a new header will be added. Users can then follow guidance from Microsoft to take additional steps, such as rejecting the email if the header is detected. Users can also disable this functionality. Microsoft has reported this vulnerability as Exploitation More Likely.

CVE-2024-49019

A vulnerability in Active Directory Certificate Services could allow an attacker to gain domain administrator privileges. According to Microsoft, you may be vulnerable if your PKI environment has the following:

• A published certificate using the version 1 certificate template.
• The Source of subject name is set to “Supplied in the request”
• The Enroll permissions are granted to a broad set of accounts,

Microsoft has reported this vulnerability as Exploitation More Likely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also colour coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted

Other Information

At the time of publication, there was one new advisory included with the November Security Guidance.

Microsoft SharePoint Server Defense in Depth Update [ADV240001]

Microsoft has published an advisory related to Microsoft SharePoint Server that provides a defense in depth update regarding redirections. Microsoft SharePoint Server Subscriber Edition, 2019, and 2016 have updates available for them.