Microsoft is starting off the year with this January Patch Tuesday release, which addresses 49 total vulnerabilities. The release includes fixes for 2 critical and 47 important vulnerabilities. Microsoft has reported that no vulnerabilities have been publicly disclosed or exploited in the wild this month.
An authenticated attacker could exploit this vulnerability by establishing a machine-in-the-middle (MITM) attack or other local network spoofing technique, then sending a malicious Kerberos message to the client victim machine to spoof itself as the Kerberos authentication server.
This critical vulnerability, with a CVSS score of 9.0, would require an attacker to first gain access to the restricted network before running an attack.
With a CVSS of 7.5, this critical vulnerability could allow an attacker to conduct remote code execution on a system running Windows Hyper-V. To successfully exploit this vulnerability the attacker must first gain access to the restricted network and win a race condition.
This important vulnerability could allow an authenticated attacker with SharePoint Site Owner privileges to remotely execute arbitrary code. Despite the authentication requirement, Microsoft reports that exploitation of this flaw is quite likely.
This important vulnerability exposes a potential avenue for attackers to carry out a machine-in-the-middle (MITM) attack, allowing them to intercept and potentially modify TLS traffic between the client and server. Exploitation of this vulnerability could lead to the decryption of sensitive information during transmission.
An important vulnerability in FBX could allow an attacker to remotely execute code on the target system. The ability to insert FBX files has been disabled in Word, Excel, PowerPoint, and Outlook for Windows and Mac and versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. 3D models in Office documents that were previously inserted from an FBX file will continue to work as expected unless the Link to File option was chosen at insert time.
For a full list of this month’s updates please see the links below:
Patch Tuesday release notes: https://msrc.microsoft.com/update-guide/releaseNote/2024-Jan
Security update guide: https://msrc.microsoft.com/update-guide/
Stuart Hare is a Technologist with a passion for helping people in all aspects of IT & Cyber Security. Stuart is the Founder of Ironshare, an Information and Cyber Security company providing consultancy and managed services.
Samuel is a Security Analyst with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
Joshua is working as a Managed Service Lead with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
