Fat Patch Tuesday, February 2024 Edition
Summary: Microsoft released updates fixing more than 70 security holes in Windows and related products, including two zero-day vulnerabilities already exploited in active attacks: CVE-2024-21412, a security feature bypass in Internet Shortcut File handling that Trend Micro ties to the Water Hydra APT group, and CVE-2024-21351, a SmartScreen bypass. Tenable's Satnam Narang noted this is the fifth Windows SmartScreen vulnerability patched since 2022, all five exploited in the wild as zero-days, and flagged CVE-2024-21410, an Exchange Server elevation of privilege flaw that could disclose NTLM hashes for relay or pass-the-hash attacks.
What you should know: An Exchange flaw that leaks NTLM hashes hands attackers a way to impersonate legitimate users without logging in, and Microsoft says it is likely to be exploited; the fix depends on upgrading to Exchange Server 2019 CU14, which enables Extended Protection for Authentication by default for the first time.