March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – Multiple Juniper Networks Products Vulnerabilities
January 15, 2024
Rewterz Threat Update – Highly Critical Microsoft SharePoint Vulnerabilities Being Actively Exploited by Threat Actors
January 15, 2024
Rewterz Threat Advisory – Multiple Juniper Networks Products Vulnerabilities
January 15, 2024
Rewterz Threat Update – Highly Critical Microsoft SharePoint Vulnerabilities Being Actively Exploited by Threat Actors
January 15, 2024
Severity
Medium
Analysis Summary
CVE-2024-20654 CVSS:8
Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the ODBC Driver component. By persuading a victim to connect to a malicious SQL database using a connection driver, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-20664 CVSS:6.5
Microsoft Windows could a remote authenticated attacker to obtain sensitive information, caused by a flaw in the Message Queuing Client (MSMQC) component. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information from heap memory and use this information to launch further attacks against the affected system.
CVE-2024-21310 CVSS:7.8
Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Cloud Files Mini Filter Driver component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to obtain SYSTEM privileges.
CVE-2024-20699 CVSS:6.5
Microsoft Windows Hyper-V is vulnerable to a denial of service. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to interact with processes of another Hyper-V guest hosted on the same Hyper-V host and cause a denial of service.
CVE-2024-20700 CVSS:7.5
Microsoft Windows Hyper-V could allow a remote attacker within the local network to execute arbitrary code on the system. By winning a race condition, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-20698 CVSS:7.5
Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Kernel component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to obtain SYSTEM privileges.
CVE-2024-20696 CVSS:7.3
Microsoft Windows could allow a local authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Libarchive component. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-20674 CVSS:9
Microsoft Windows could allow a remote authenticated attacker within the local network to bypass security restrictions, cause by a flaw in the Kerberos component. By carrying out a man-in-the-middle attack and sending a malicious Kerberos message to the client, and attacker could exploit this vulnerability to spoof the Kerberos authentication server.
CVE-2024-20694 CVSS:5.5
Microsoft Windows could a local authenticated attacker to obtain sensitive information, caused by a flaw in the CoreMessaging component. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information from stack memory and use this information to launch further attacks against the affected system.
CVE-2024-21307 CVSS:8.1
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Remote Desktop Client component. By winning a race condition, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-20691 CVSS:4.7
Microsoft Windows could a local authenticated attacker to obtain sensitive information, caused by a flaw in the Themes component. By winning a race condition, an attacker could exploit this vulnerability to obtain sensitive information from initialized or uninitialized memory in the process heap and use this information to launch further attacks against the affected system.
CVE-2024-20697 CVSS:7.3
Microsoft Windows could allow a local authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Libarchive component. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-21305 CVSS:4.4
Microsoft Windows could allow a local authenticated attacker to bypass security restrictions, cause by a flaw in the Hypervisor-Protected Code Integrity (HVCI) component. An attacker could exploit this vulnerability to bypass security features and compromise administrative credentials.
CVE-2024-21313 CVSS:5.3
Microsoft Windows could a remote attacker to obtain sensitive information, caused by a flaw in the TCP/IP component. By persuading a victim to open specially crafted content, an attacker could exploit this vulnerability to obtain sensitive information from IPsec packets from other sessions on a server and then use this information to launch further attacks against the affected system.
CVE-2024-20666 CVSS:6.6
Microsoft Windows could allow a physical authenticated attacker to bypass security restrictions, cause by a flaw in the BitLocker component. An attacker could exploit this vulnerability to bypass security features and cause an impact on confidentiality, integrity and availability.
Impact
- Denial of Service
- Privilege Escalation
- Information Disclosure
- Code Execution
- Security Bypass
Indicators Of Compromise
CVE
- CVE-2024-20654
- CVE-2024-20664
- CVE-2024-21310
- CVE-2024-20699
- CVE-2024-20700
- CVE-2024-20698
- CVE-2024-20696
- CVE-2024-20674
- CVE-2024-20694
- CVE-2024-21307
- CVE-2024-20691
- CVE-2024-20697
- CVE-2024-21305
- CVE-2024-21313
- CVE-2024-20666
Affected Vendors
Microsoft
Affected Products
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
- Microsoft Windows 10 x64
- Microsoft Windows 10 1809 for 32-bit Systems
- Microsoft Windows 10 1809 for x64-based Systems
- Microsoft Windows 10 1809 for ARM64-based Systems
- Microsoft Windows Server 2012
- Microsoft Windows Server 2012 R2
- Microsoft Windows 10 x32
- Microsoft Windows Server (Server Core installation) 2019
- Microsoft Windows Server (Server Core installation) 2016
- Microsoft Windows Server (Server Core installation) 2012 R2
- Microsoft Windows Server (Server Core installation) 2012
- Microsoft Windows Server for X64-based systems (Server Core installation) 2008 SP2
- Microsoft Windows Server (Server Core installation) 2022
- Microsoft Windows 10 1607 for 32-bit Systems
- Microsoft Windows 10 1607 for x64-based Systems
- Microsoft Windows Server 2022
- Microsoft Windows Server for X64-based systems 2008 SP2
- Microsoft Windows 10 21H2 for 32-bit Systems
- Microsoft Windows 10 21H2 for ARM64-based Systems
- Microsoft Windows 10 21H2 for x64-based Systems
- Microsoft Windows Server for X64-based systems 2008 R2 SP1
- Microsoft Windows 11 22H2 for ARM64-based Systems
- Microsoft Windows 11 22H2 for x64-based Systems
- Microsoft Windows Server for X64-based systems (Server Core installation) 2008 R2 SP1
- Microsoft Windows 10 22H2 for x64-based Systems
- Microsoft Windows 10 22H2 for 32-bit Systems
- Microsoft Windows 10 22H2 for ARM64-based Systems
- Microsoft Windows 11 21H2 for ARM64-based Systems
- Microsoft Windows 11 21H2 for x64-based Systems
- Microsoft Windows Server (Server Core installation) 2022 23H2
- Microsoft Windows 11 23H2 for ARM64-based Systems
- Microsoft Windows 11 23H2 for x64-based Systems
Remediation
Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.