Today’s VERT Alert addresses Microsoft’s June 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1110 as soon as coverage is completed.
In-The-Wild & Disclosed CVEs
The only disclosed vulnerability we have this month, is CVE-2023-50868, a DNSSEC protocol level vulnerability that can lead to denial of service. The vulnerability is a CPU Exhaustion related to the Closest Encloser Proof in NSEC3, a mechanism within DNSSEC. NSEC3 is the improved version of NSEC, a technology that helps prevent against DNS Cache Poisoning for non-existent records (among other things) by providing authenticated denial of existence. In other words, it authoritatively proves that a record does not exist. Since NSEC could be used for domain enumeration, NSEC3 was introduced with the inclusion of hashing techniques. An attacker can cause excessive SHA-1 computations leading to the CPU Exhaustion. Since this is a protocol level vulnerability, other DNS solutions including PowerDNS, Bind, and dnsmasq are impacted and have updates available. According to most vendors, this vulnerability can be mitigated by turning DNSSEC validations off. Microsoft has reported this vulnerability as Exploitation Less Likely.
CVE Breakdown by Tag
While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.
- Traditional Software
- Mobile Software
- Cloud or Cloud Adjacent
- Vulnerabilities that are being exploited or that have been disclosed will be highlighted
|
Tag |
CVE Count |
CVEs |
|
Windows Remote Access Connection Manager |
1 |
CVE-2024-30069 |
|
Windows DHCP Server |
1 |
CVE-2024-30070 |
|
Windows Event Logging Service |
1 |
CVE-2024-30072 |
|
Windows Link Layer Topology Discovery Protocol |
2 |
CVE-2024-30074, CVE-2024-30075 |
|
Windows Container Manager Service |
1 |
CVE-2024-30076 |
|
Microsoft WDAC OLE DB provider for SQL |
1 |
CVE-2024-30077 |
|
Windows Wi-Fi Driver |
1 |
CVE-2024-30078 |
|
Windows Server Service |
2 |
CVE-2024-30080, CVE-2024-30062 |
|
Windows Win32K – GRFX |
3 |
CVE-2024-30082, CVE-2024-30087, CVE-2024-30091 |
|
Windows Kernel-Mode Drivers |
2 |
CVE-2024-35250, CVE-2024-30084 |
|
Azure SDK |
1 |
CVE-2024-35255 |
|
Microsoft Windows |
1 |
CVE-2023-50868 |
|
Visual Studio |
3 |
CVE-2024-29187, CVE-2024-29060, CVE-2024-30052 |
|
Microsoft Edge (Chromium-based) |
7 |
CVE-2024-5493, CVE-2024-5498, CVE-2024-5496, CVE-2024-5499, CVE-2024-5494, CVE-2024-5497, CVE-2024-5495 |
|
Windows Distributed File System (DFS) |
1 |
CVE-2024-30063 |
|
Windows Kernel |
2 |
CVE-2024-30064, CVE-2024-30068 |
|
Windows Themes |
1 |
CVE-2024-30065 |
|
Winlogon |
2 |
CVE-2024-30066, CVE-2024-30067 |
|
Windows Standards-Based Storage Management Service |
1 |
CVE-2024-30083 |
|
Windows Cloud Files Mini Filter Driver |
1 |
CVE-2024-30085 |
|
Windows Win32 Kernel Subsystem |
1 |
CVE-2024-30086 |
|
Windows NT OS Kernel |
2 |
CVE-2024-30088, CVE-2024-30099 |
|
Microsoft Streaming Service |
2 |
CVE-2024-30089, CVE-2024-30090 |
|
Windows Storage |
1 |
CVE-2024-30093 |
|
Windows Routing and Remote Access Service (RRAS) |
2 |
CVE-2024-30094, CVE-2024-30095 |
|
Windows Cryptographic Services |
1 |
CVE-2024-30096 |
|
Microsoft Windows Speech |
1 |
CVE-2024-30097 |
|
Microsoft Office SharePoint |
1 |
CVE-2024-30100 |
|
Microsoft Office |
2 |
CVE-2024-30101, CVE-2024-30104 |
|
Microsoft Office Word |
1 |
CVE-2024-30102 |
|
Microsoft Office Outlook |
1 |
CVE-2024-30103 |
|
Dynamics Business Central |
2 |
CVE-2024-35248, CVE-2024-35249 |
|
Azure Storage Library |
1 |
CVE-2024-35252 |
|
Azure File Sync |
1 |
CVE-2024-35253 |
|
Azure Monitor |
1 |
CVE-2024-35254 |
|
Microsoft Dynamics |
1 |
CVE-2024-35263 |
|
Windows Perception Service |
1 |
CVE-2024-35265 |
|
Azure Data Science Virtual Machines |
1 |
CVE-2024-37325 |
Other Information
At the time of publication, there were no new advisories included with the June Security Guidance.
