Microsoft has begun the year with patches for a near-half century of CVEs, although there were no zero-day bugs addressed in the January 2024 Patch Tuesday yesterday.
The haul included fixes for just two critical CVEs: impacting the Windows Kerberos authentication protocol and the Windows Hyper-V virtualization offering.
It is a security feature bypass vulnerability with a CVSS score of 9.0, which could allow unauthorized exploitation of Kerberos authentication.
To exploit the bug, a threat actor would need to craft a machine-in-the-middle attack or local network spoofing to pose as the Kerberos authentication server, and send a malicious message to the targeted machine, according to Action1 president, Mike Walters.
Although there's no exploit code currently available, the bug is known to affect Windows 10, Windows 11, Windows Server 2019 and Windows Server 2022.
The second critical vulnerability, in Windows Hyper-V, is marked as CVE-2024-20700 and has a CVSS score of 7.5.
Successful exploitation of the security feature bypass vulnerability could enable a threat actor to carry out a MITM attack and decrypt and read or modify TLS traffic between client and server.
Although attack complexity is high, the threat is potentially significant for organizations.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Wed, 10 Jan 2024 09:30:19 +0000