Patch Tuesday, December 2024 Edition

Summary: Microsoft released updates to fix at least 70 security holes in Windows and Windows software, including CVE-2024-49138, a zero-day elevation of privilege flaw in the Windows Common Log File System (CLFS) driver that is already being exploited in active attacks. Tenable's year-end tally counted 1,009 Microsoft security bugs patched in 2024, 29% of them elevation of privilege flaws, while Fortra counted 1,088, similar to 1,063 in 2023 and 1,119 in 2022.
Bottom line: Rapid7's Adam Barnett said ransomware authors who abused previous CLFS vulnerabilities will be pleased to get a fresh one, and expects more CLFS zero-days until Microsoft fully replaces the aging codebase. Separately, CVE-2024-49112, a remote code execution flaw in LDAP on every Windows version since Windows 7, carries a CVSS score of 9.8 and, per Immersive Labs' Rob Reeves, has low attack complexity and requires no authentication.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-49112 CVE-2024-49138
Related: Microsoft Patch Tuesday for December 2024 contains four critical vulnerabilities Cyber Risks ·
CVE-2024-49138: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Dec 10, 2024
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026