Microsoft’s October 2024 Patch Tuesday: Addressing 5 Zero-Days and 118 Vulnerabilities

On October 10, 2024, Microsoft released its latest round of security updates as part of the monthly Patch Tuesday. This month’s update addresses a total of 118 vulnerabilities, including five zero-days, two of which are actively being exploited. These vulnerabilities impact various Microsoft products, making it crucial for organizations to apply patches promptly and review any mitigations or workarounds. 

Let’s break down the key vulnerabilities and what steps organizations should take to protect themselves. 

What are the zero-day vulnerabilities mentioned in Microsoft’s October 2024 Patch Tuesday?  

Of the 118 vulnerabilities addressed this month, five were publicly disclosed zero-days, and two are known to have been actively exploited in the wild. These include: 

• CVE-2024-43573 – Windows MSHTML Platform Spoofing Vulnerability: This vulnerability allows attackers to use spoofing techniques through MSHTML, the rendering engine used by Internet Explorer and other applications. By exploiting this flaw, attackers can craft malicious websites that appear legitimate, potentially tricking users into disclosing sensitive information. 
• CVE-2024-43572 – Microsoft Management Console Remote Code Execution Vulnerability: This critical vulnerability allows remote code execution via the Microsoft Management Console (MMC). If exploited, attackers could take control of affected systems and execute arbitrary code, potentially leading to data theft or system disruption. 

The remaining three zero-days, while not currently exploited, were publicly disclosed and should still be prioritized for patching: 

• CVE-2024-6197 – Open Source Curl Remote Code Execution Vulnerability: A vulnerability within the widely used curl tool that could allow attackers to execute code on a targeted system. 
• CVE-2024-20659 – Windows Hyper-V Security Feature Bypass Vulnerability: This vulnerability allows attackers to bypass security features within Hyper-V, Microsoft’s virtualization technology, putting virtualized environments at risk. 
• CVE-2024-43583 – Winlogon Elevation of Privilege Vulnerability: This vulnerability could allow attackers to elevate their privileges within Windows systems, gaining greater control over the affected machine. 

What is Nuspire doing? 

At Nuspire, we are dedicated to keeping our clients secure by staying ahead of emerging threats. Our team applies patches as they are released, following vendor recommendations to ensure system stability and security. Additionally, we conduct active threat hunting to identify any signs of compromise in client environments. 

What should I do? 

For organizations looking to safeguard their systems, it’s critical to act swiftly in response to Microsoft’s October Patch Tuesday. Here’s what you need to do: 

• Apply Patches Promptly: Focus on patching systems affected by the two actively exploited vulnerabilities: CVE-2024-43573 (Windows MSHTML Platform) and CVE-2024-43572 (Microsoft Management Console). These are the most urgent threats, and delaying patches could leave your systems open to attacks. 
• Review Microsoft’s Full List of CVEs: In addition to the actively exploited zero-days, reviewing the full list of vulnerabilities addressed in this month’s update is essential. Microsoft often provides detailed information on each CVE, including any potential workarounds or mitigations. If immediate patching isn’t feasible, these mitigations can offer temporary protection. 
• Conduct Regular Vulnerability Scans: Even after patching, regularly scan your environment to ensure that all systems have been updated. Some systems may be overlooked, especially in larger organizations with complex environments. Routine vulnerability scanning can help you identify systems that still need to be patched and ensure compliance across your organization. 

Microsoft’s October 2024 Patch Tuesday brings significant security updates, with five zero-days and 118 vulnerabilities addressed. Organizations should prioritize patching systems vulnerable to the two actively exploited zero-days, as these pose the most immediate risk. By staying vigilant and ensuring your patch management process is robust, you can significantly reduce the chances of an attacker exploiting these vulnerabilities in your environment. 

At Nuspire, we continue to support our clients through proactive patching and ongoing threat hunting. Staying on top of these monthly updates is essential, but it’s just one part of a broader cybersecurity strategy. With the Nuspire Cybersecurity Experience, we help you adopt a proactive and unified approach to security, leveraging AI and real-time insights to anticipate and prevent future threats. 

If you need more guidance or support, don’t hesitate to reach out to our experts. Ensuring your cybersecurity defenses are up-to-date is crucial in today’s ever-evolving threat landscape. Let us help you stay ahead of the threats that matter most.