December introduced a comparatively gentle Patch Tuesday, with one vulnerability being actively exploited. Of all 70 vulnerabilities mounted, 16 have been labeled as important.

“This yr, cybersecurity professionals needs to be on Santa’s good checklist, or at the least Microsoft’s,” Tyler Reguly, affiliate director of safety R&D at cybersecurity software program and providers firm Fortra, informed TechRepublic in an e mail.

Microsoft patches leaking CLFS

CVE-2024-49138 is an elevation of privilege vulnerability within the Home windows Frequent Log File System (CLFS) driver. The motive force is a key factor of Home windows used to put in writing transaction logs. Abusing the driving force, particularly by way of improper limits checking, may permit an attacker to achieve SYSTEM privileges. From there, they may steal information or set up backdoors.

“Provided that CLFS is a regular part throughout a number of variations of Home windows, together with server and shopper installations, the vulnerability has in depth attain, notably in enterprise environments,” Mike Walters, president and co-founder of Action1, informed TechRepublic in an e mail .

Addressing this vulnerability needs to be a excessive precedence because it has already been exploited.

Microsoft has launched fixes for eight different CLFS vulnerabilities this yr, in line with Reguly.

“Nevertheless, that is an enchancment for Microsoft, which resolved 12 CLFS vulnerabilities in 2022 and 10 CLFS vulnerabilities in 2023,” Reguly wrote.

SEE: The US sanctioned Chinese language safety agency Sichuan Silence for exploiting a vulnerability in Sophos firewalls utilized in authorities infrastructure.

‘Tis the season… for distant code execution

One vulnerability scored increased than 9 on the CVSS severity scale: CVE-2024-49112which scored CVSS 9.8. A distant code execution vulnerability may permit an attacker to execute code throughout the Home windows Light-weight Listing Entry Protocol (LDAP) service.

“Home windows Server methods performing as area controllers (DCs) are notably in danger given their important position in managing listing providers,” Walters stated.

This makes December a very good time to put in the patch for this vulnerability and to recollect an essential issue of safety hygiene: Area controllers mustn’t have Web entry. Reguly identified that corporations that observe the Protection Division’s DISA STIG for Energetic Listing domains have already blocked area controllers from Web connections.

Motion 1 famous that 9 of the December vulnerabilities have been associated to attainable distant code execution.

“Organizations ought to keep away from exposing RDP providers to the worldwide Web and implement sturdy safety controls to mitigate dangers,” Walters wrote. “These flaws additional show the risks of leaving HOP open and unprotected.”

“If nothing else, we are able to say that Microsoft is constant,” Reguly added. “Whereas it might be good to see the variety of vulnerabilities lower every year, at the least consistency lets us know what to anticipate. Since Microsoft has CISA’s Safe by Design pledge signedcan we see these numbers drop sooner or later.”

Time to enroll in Apple, Google Chrome, and different Patch Tuesday safety updates

Many different corporations time their month-to-month releases for the second Tuesday of the month. Adobe offers an inventory of safety updates. Different nice spots, as collected by Motion 1embody:

• Patch for vulnerabilities in Google Chrome and Mozilla Firefox.
• A safety replace for greater than 100 Cisco units working the NX-OS information center-focused working system.
• Fixes for numerous native privilege escalation vulnerabilities in Linux.
• Patches for 2 actively exploited zero-day vulnerabilities in Macs with Intel chips.

An entire checklist of Home windows safety updates could be discovered at Microsoft Help.