December 2024 Windows Security Update: 72 Vulnerabilities Fixed

As Windows users wrapped up their 2024 Patch Tuesday celebrations, Microsoft unleashed an impressive army of patches aimed at combating the ever-present threat of cyber vulnerabilities. In total, 72 security flaws across its software ecosystem were squashed, including a particularly nasty one that has been wreaking havoc as it was actively exploited in the wild. Let's dive into the details of this significant update, the implications it carries, and what users need to know to safeguard their systems.

A Closer Look at the December Updates​

According to Microsoft’s official disclosure, this update is no small feat. Among the 72 security flaws, 17 were rated as Critical, with 54 deemed Important and one lingering as Moderate. This month’s haul includes 31 vulnerabilities that could allow for remote code execution, and 27 that enable elevation of privileges. In a broader context, Microsoft has tackled an astonishing 1,088 vulnerabilities throughout 2024 alone, as highlighted by Fortra.

Spotlight on the CLFS Vulnerability​

The standout vulnerability this month, bearing the identifier CVE-2024-49138, is a privilege escalation flaw tied to the Windows Common Log File System (CLFS) Driver with a CVSS score of 7.8. This vulnerability poses a significant threat, as it enables attackers to gain SYSTEM privileges after successful exploitation. The advisory credits cybersecurity firm CrowdStrike for discovering and reporting this flaw, which is notably the fifth actively exploited CLFS-related vulnerability flagged since 2022.
Reflecting on this trend, Satnam Narang from Tenable notes a concerning pattern: ransomware operators have increasingly exploited CLFS elevation flaws. Unlike sophisticated, patient threat actors who prefer precision attacks, ransomware affiliates often opt for a more chaotic 'smash and grab' approach, leveraging these flaws to infiltrate networks, steal, encrypt data, and extort their victims.

Mitigations and Future Protections​

In response to this escalating threat landscape, Microsoft is not sitting on its laurels. They are working to implement new verification steps when parsing log files. Instead of merely checking individual log values, the CLFS will incorporate Hash-based Message Authentication Codes (HMAC) to authenticate the integrity of log files and detect unauthorized modifications.
In tandem with this, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed the CVE-2024-49138 vulnerability into its Known Exploited Vulnerabilities (KEV) catalog, compelling federal agencies to remediate the flaw by December 31, 2024.

The Notable Threats of December​

Further raising the stakes in this month’s update is the highly critical CVE-2024-49112, a remote code execution flaw haunting the Windows LDAP service, boasting a CVSS score of 9.8. An unauthenticated attacker could exploit this vulnerability through specially crafted LDAP calls, potentially executing arbitrary code within the LDAP service context.
Other serious vulnerabilities include:

• CVE-2024-49117: A remote code execution flaw in Windows Hyper-V (CVSS score: 8.8).
• CVE-2024-49105: A similar risk found in the Remote Desktop Client (CVSS score: 8.4).
• CVE-2024-49063: Affecting Microsoft Muzic (CVSS score: 8.4).

The Ongoing NTLM Troubles​

Amid the flurry of patches, there are still unresolved matters regarding the NTLM (NT LAN Manager) protocol, infamous for its vulnerability to relay and pass-the-hash attacks. Recently, 0patch released unofficial fixes for a zero-day vulnerability that can expose user's NTLM credentials simply by viewing a rogue file in Windows Explorer. The implications of such vulnerabilities are dire as they can facilitate unauthorized access to sensitive data and systems.
With NTLM facing severe scrutiny, Microsoft's plans to phase it out in favor of Kerberos authentication are more critical than ever. Moreover, enhancements have been rolled out to Exchange 2019 and Azure Directory Certificate Services (AD CS), fortifying these services by enabling Extended Protection for Authentication (EPA) by default.

Conclusion​

Windows 11 users and administrators should prioritize these security patches released in December. With Microsoft’s track record of frequent patch updates, attentiveness to these vulnerabilities is paramount. Cybercriminals are relentless in their quest for exploitation, and vigilance against evolving threats, especially those targeting trust protocols like NTLM, is imperative for maintaining a secure working environment.
As we gear up for another year of patching and protective measures, sound advice includes staying informed, applying patches promptly, and considering enhanced security practices to outsmart malicious actors. Remember, in the world of cybersecurity, being one step ahead often means the difference between security and chaos.

Got Questions or Concerns?​

Feel free to share your thoughts and experiences regarding the latest security patches. How do you manage updates on your Windows systems? What additional precautions do you take to protect your data? Let's discuss below!

---

Source: The Hacker News Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability