Patch Tuesday de julio

El análisis del Patch Tuesday de Ivanti va más allá de la aplicación de parches a sus aplicaciones y le ofrece la inteligencia y orientación necesarias para priorizar dónde debes enfocarte. Consulta los últimos análisis en nuestro blog Ivanti y únete a los expertos del sector en el webinar de Patch Tuesday. En él profundizaremos en cada uno de los informes y ofreceremos orientación sobre los riesgos asociados a las vulnerabilidades más recientes.

1. Presentado por Patricia Cobo y Kamel Karabelli
Patch Tuesday Webinar
Jueves 11 julio 2024

2. Copyright © 2024 Ivanti. All rights reserved. 2
Agenda
§July 2024 Patch Tuesday Overview
§In the News
§Bulletins and Releases
§Between Patch Tuesdays
§Q & A

3. Copyright © 2024 Ivanti. All rights reserved. 3
Microsoft has resolved a total of 142 unique CVEs this
month including two Zero-day vulnerabilities (CVE-
2024-38112 and CVE-2024-38080) and two publicly
disclosed vulnerabilities (CVE-2024-37985 and CVE-
2024-35264). The two Zero-days and one of the public
disclosures are in the Windows OS making that your
top priority this month. Last, but not least, don't forget
your browsers. Mozilla Firefox, Google Chrome, and
Edge will all be in need of updates.
For more details check out thismonth's Patch Tuesday
blog.
July Patch Tuesday 2024

4. Copyright © 2024 Ivanti. All rights reserved. 4
In the News

5. Copyright © 2024 Ivanti. All rights reserved. 5
In the News
§Delay in Recall feature
§https://www.bleepingcomputer.com/news/microsoft/microsoft-delays-windows-recall-amid-privacy-and-security-
concerns/
§Preview in Action
§https://www.bleepingcomputer.com/news/microsoft/microsoft-resumes-rollout-of-windows-11-kb5039302-
update-for-most-users/
§New Vulnerability Exploits
§https://www.darkreading.com/cyberattacks-data-breaches/moveit-transfer-flaws-security-defense-attackers
§Attackers Already Exploiting Flaws in Microsoft's July Security Update
§https://www.darkreading.com/application-security/attackers-already-exploiting-flaws-in-microsofts-july-security-
update

6. Copyright © 2024 Ivanti. All rights reserved. 6
§CVE-2024-38112 Windows MSHTML Platform Spoofing Vulnerability
§CVSS 3.1 Scores: 7.5 / 7.0
§Severity: Important
§Impact: Spoofing
§Affected Systems: All currently supported versions of the Windows operating system
§Per Microsoft: An attacker would have to send the victim a malicious file that the victim would have to
execute.
§CVE-2024-38080 Windows Hyper-V Elevation of Privilege Vulnerability
§CVSS 3.1 Scores: 7.8 / 6.8
§Severity: Important
§Impact: Elevation of Privilege
§Affected Systems: Windows 11 and Server 2022
§Per Microsoft: An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Known Exploited Vulnerabilities

7. Copyright © 2024 Ivanti. All rights reserved. 7
§CVE-2024-35264 .NET and Visual Studio Remote Code Execution Vulnerability
§CVSS 3.1 Scores: 8.1 / 7.1
§Severity: Important
§Impact: Remote Code Execution
§Affected Systems: .NET 8.0 and Visual Studio 2022 v17.4 – 17.10
§Per Microsoft: An attacker could exploit this by closing an http/3 stream while the request body is being
processed leading to a race condition. This could result in remote code execution.
§ARMCVE-2024-37985 Systematic Identification and Characterization of Proprietary Prefetchers
§CVSS 3.1 Scores: 5.8 / 5.2
§Severity: Important
§Impact: Information Disclosure
§Affected Systems: Windows 11 22H2 and 23H2 ARMx64 systems
§Per Microsoft: An attacker who successfully exploited this vulnerability could view heap memory from a
privileged process running on the server.
Publicly Disclosed Vulnerabilities

8. Copyright © 2024 Ivanti. All rights reserved. 8
CVE-2024-6387
§CVSS 3: 8.1
§A flaw in OpenSSH versions ( <4.4 and between 8.5 an 9.8 ) allows a remote attacker to cause the sshd service to crash and execute attacker-controlled code, by letting connection attempts reach the timeout period (120s by default).
§This can be used to obtain root-level shell access remotely, but it can take 8 hours to a week to exploit. Exploit depends on crashing ssh on a particular part of the sshd code, which can take multiple attempts.
§This flaw resurfaced in the openssh code after being reintroduced in 2020. It had been present in the code, and fixed, circa 2006.
Impact
There are several million internet-facing ssh servers
potentially vulnerable, but the length of the attack
makes a widespread exploit unlikely – though it
could be used in targeted attacks.
Mitigation
Updating to the latest OpenSSH version is the best
alternative. Removing ssh from Internet-facing
systems (and use a VPN prior to connecting) is the
best practice.
New and Notable Linux Vulnerabilities: 1
Highlighted by TuxCare

9. Copyright © 2024 Ivanti. All rights reserved. 9
CVE-2024-22211
CVSS 3: 9.8
§FreeRDP is a set of Remote Desktop-compatible
client and server implementations for Linux-
based systems.
§Versions prior to 2.11.5 (on the 2.x series) and
3.2.0 (on the 3.x series) of the client
implementation can be tricked by a malicious
server into crashing and potentially leveraged for
other purposes (so far, not disclosed).
Importance
This vulnerability is relevant because it affects
CentOS 7, which went past the End-of-Life date at
the end of June, and as such, will have no updates
forthcoming.
Mitigation
Compiling your own secure version, or obtaining an
updated package from an extended support vendor
is the only available option.
New and Notable Linux Vulnerabilities: 2
Highlighted by TuxCare

10. Copyright © 2024 Ivanti. All rights reserved. 10
CVE-2024-2961
§CVSS 3: 8.8
§Iconv, a function used to convert text between
different encodings and included in glibc, has
been found to overflow a buffer when converting
strings to ISO-2022-CN-EXT character set.
§This may be used to crash applications relying
on iconv (of which there are plenty) and be used
as a denial-of-service against specific vulnerable
applications and services.
Impact
Affects glibc up to version 2.39.
Mitigation
Updating past this version is advised. Impacts
Enterprise Linux versions 6, 7, 8 and 9, and Ubuntu
16.04 and 18.04.
New and Notable Linux Vulnerabilities: 3
Highlighted by TuxCare

11. Copyright © 2024 Ivanti. All rights reserved. 11
Microsoft Patch Tuesday Updates of Interest
Advisory 990001
Latest Servicing Stack Updates (SSU)
§https://msrc.microsoft.com/update-
guide/en-US/vulnerability/ADV990001
§Server 2012/2012 R2 ESU and Windows
10 (see graphic)
Azure and Development Tool Updates
§.NET 8
§Azure CycleCloud 7.9.2 – 8.5.0
§Azure Network Watcher VM Extension
§Visual Studio 2022 v17.4 – v17.10
Source: Microsoft

12. Copyright © 2024 Ivanti. All rights reserved. 12
Windows 10
and 11 Lifecycle
Awareness
Windows 10 Enterprise and Education
VersionRelease DateEnd of Support Date
22H210/18/202210/14/2025
Windows 10 Home and Pro
VersionRelease DateEnd of Support Date
22H210/18/202210/14/2025
Windows 11 Home and Pro
VersionRelease DateEnd of Support Date
23H210/31/202311/11/2025
22H29/20/202210/8/2024
Windows 11 Enterprise and Education
VersionRelease DateEnd of Support Date
23H210/31/202311/10/2026
22H29/20/202210/14/2025
21H210/4/202110/8/2024
Source: Microsoft
https://docs.microsoft.com/en-us/lifecycle/faq/windows

13. Copyright © 2024 Ivanti. All rights reserved. 13
Server Long-term Servicing Channel Support
Server LTSC Support
VersionEditionsRelease DateMainstream Support EndsExtended Support Ends
Windows Server 2022Datacenter and Standard08/18/202110/13/202610/14/2031
Windows Server 2019
(Version 1809)Datacenter, Essentials, and Standard11/13/201801/09/202401/09/2029
Windows Server 2016
(Version 1607)Datacenter, Essentials, and Standard10/15/201601/11/202201/11/2027
https://learn.microsoft.com/en-us/windows-server/get-started/windows-server-release-info
§Focused on server long-term stability
§Major version releases every 2-3 years
§5 years mainstream and 5 years extended support
§Server core or server with desktop experience available
Source: Microsoft

14. Copyright © 2024 Ivanti. All rights reserved. 14
Patch Content Announcements
Announcements Posted on Community Forum Pages
§https://forums.ivanti.com/s/group/CollaborationGroup/00Ba0000009oKICEA2
§Subscribe to receive email for the desired product(s)
Content Info: Endpoint Security
Content Info: Endpoint Manager
Content Info: macOS Updates
Content Info: Linux Updates
Content Info: Patch for Configuration Manager
Content Info: ISEC and Neurons Patch
Content Info: Neurons Patch for InTune

15. Copyright © 2024 Ivanti. All rights reserved. 15
Bulletins and Releases

16. Copyright © 2024 Ivanti. All rights reserved.
MFSA-2024-29: Security Update Firefox 128
§Maximum Severity: Important
§Affected Products: Security Update Firefox
§Description: This update from Mozilla addresses security vulnerabilities in the Firefox browser on
multiple platforms. Fixes 16 vulnerabilities; 4 are rated High.
§Impact: Remote Code Execution, Denial of Service, Elevation of Privilege, Information
Disclosure
§Fixes 16 Vulnerabilities: See the Mozilla Security Advisory https://www.mozilla.org/en-
US/security/advisories/mfsa2024-29/ for complete details.
§Restart Required: Requires application restart
§Known Issues: None
12

17. Copyright © 2024 Ivanti. All rights reserved.
MFSA-2024-30: Security Update Firefox ESR 115.13
§Maximum Severity: Important
§Affected Products: Security Update Firefox ESR
§Description: This update from Mozilla addresses security vulnerabilities in the Firefox ESR
browser on multiple platforms. Fixes 5 vulnerabilities; 3 are rated High.
§Impact: Remote Code Execution, Denial of Service, Information Disclosure
§Fixes 5 Vulnerabilities: See the Mozilla Security Advisory https://www.mozilla.org/en-
US/security/advisories/mfsa2024-30/ for complete details.
§Restart Required: Requires application restart
§Known Issues: None
12

18. Copyright © 2024 Ivanti. All rights reserved. 18
MS24-07-W11: Windows 11 Update
§Maximum Severity: Critical
§Affected Products: Microsoft Windows 11 Version 21H2, 22H2, 23H2 and Edge Chromium
§Description: This bulletin references KB 5040431 (21H2) and KB 5040442 (22H2/23H2). See
KBs for details of all changes.
§Impact: Remote Code Execution, Security Feature Bypass, Denial of Service, Spoofing,
Elevation of Privilege, and Information Disclosure
§Fixes 74 Vulnerabilities: CVE-2024-37985 is publicly disclosed, and CVE-2024-38080 and CVE-
2024-38112 are known exploited. See the Security Update Guide for the complete list of CVEs.
§Restart Required: Requires restart
§Known Issues: See next slide
1

19. Copyright © 2024 Ivanti. All rights reserved. 19
July Known Issues for Windows 11
§KB 5040431 – Windows 11 version 21H2, all editions
§[Prof_Pic] After installing this update, you might be unable to change your user account
profile picture. When attempting to change a profile picture by selecting the button Start>
Settings> Accounts > Your info, and then selecting Choose a file, you might receive an error
message with error code 0x80070520. Workaround: Microsoft is working on a resolution
§KB 5040442 – Windows 11 version 22H2 and 23H2, all editions
§[Ent_Up] After installing this update or later updates, you might face issues while upgrading
from Windows Pro to a valid Windows Enterprise subscription.
Resulting from this operation, you might observe the following symptoms: - OS upgrade
operations may fail, and this might be shown in the LicenseAcquisition scheduled task in
Task Scheduler -> Task Scheduler Library -> Microsoft -> Windows -> Subscription as
‘Access denied error (error code 0x80070005)’ under ‘Last Run Result’
•Workaround: Microsoft is working on a resolution.

20. Copyright © 2024 Ivanti. All rights reserved. 20
MS24-07-W10: Windows 10 Update
§Maximum Severity: Critical
§Affected Products: Microsoft Windows 10 Versions 1607, 1809, 22H2, Server 2016, Server
2019, Server 2022, Server 2022 Datacenter: Azure Edition and Edge Chromium
§Description: This bulletin references 6 KB articles. See KBs for details of all changes.
§Impact: Remote Code Execution, Security Feature Bypass, Denial of Service, Spoofing,
Elevation of Privilege, and Information Disclosure
§Fixes 74 Vulnerabilities: CVE-2024-38080 and CVE-2024-38112 are known exploited. No CVEs
are reported publicly disclosed. See the Security Update Guide for the complete list of CVEs.
§Restart Required: Requires restart
§Known Issues: See next slide
1

21. Copyright © 2024 Ivanti. All rights reserved. 21
July Known Issues for Windows 10
§KB 5040430 – Win 10 Enterprise LTSC 2019, Win 10 IoT Enterprise LTSC 2019, Windows 10
IoT Core 2019 LTSC, Windows Server 2019
§[Language Change] After installing KB5039217, released June 11, 2024, you might
observe a change in language for context menus and dialog buttons in Windows
applications. Parts of the UI might display in English when English is not set as the
Windows display language. In addition, font size might change for the names of tabs and
buttons
§Workaround: Microsoft is working on a resolution.

22. Copyright © 2024 Ivanti. All rights reserved. 22
July Known Issues for Windows 10 (cont)
§KB 5040427 – Windows 10 Enterprise LTSC 2021, Windows 10 IoT Enterprise LTSC 2021,
Windows 10, version 22H2, all editions
§[Cache] After you install KB5034203 (dated 01/23/2024) or later updates, some Windows
devices that use the DHCP Option 235 to discover Microsoft Connected Cache (MCC)
nodes in their network might be unable to use those nodes. Instead, these Windows
devices will download updates and apps from the public internet. Workaround: See KB for
configuration options.
§[Prof_Pic]
§Microsoft is working on a resolution for both issues.
§KB 5040437 – Windows Server 2022
§[Prof_Pic]

23. Copyright © 2024 Ivanti. All rights reserved. 23
§Maximum Severity: Critical
§Affected Products: Microsoft SharePoint Server Subscription Edition, SharePoint Enterprise
Server 2016, and SharePoint Server 2019
§Description: This security update resolves several Microsoft SharePoint Server remote code
execution and information disclosure vulnerabilities. This bulletin is based on KB 5002615
(2019), KB 5002606 (sub), and KB 5002618 (2016) articles.
§Impact: Remote Code Execution, Information Disclosure
§Fixes 4 Vulnerabilities: CVE-2024-32987, CVE-2024-38023, CVE-2024-38024, and CVE-2024-
38044. No CVEs are reported exploited or publicly disclosed.
§Restart Required: Requires application restart
§Known Issues: None reported
MS24-07-SPT: Security Updates for Sharepoint Server1

24. Copyright © 2024 Ivanti. All rights reserved. 24
MS24-07-SQL: Security Updates for SQL Server
§Maximum Severity: Important
§Affected Products: Microsoft SQL Server 2016 SP3 (GDR and Azure Connect Feature Pack),
Microsoft SQL Server 2017 (GDR and CU31), Microsoft SQL Server 2019 (GDR and CU27)
and Microsoft SQL Server 2022 (GDR and CU13)
§Description: This security update fixes a series of Microsoft OLE DB Driver vulnerabilities which
could allow remote code execution. This bulletin is based on 8 KB articles.
§Impact: Remote Code Execution
§Fixes 38 Vulnerabilities: No CVEs are known exploited or publicly disclosed. See the Security
Update Guide for the complete list of CVEs.
§Restart Required: Requires restart
§Known Issues: None reported
2

25. Copyright © 2024 Ivanti. All rights reserved. 25
§Maximum Severity: Important
§Affected Products: Office Professional Plus 2016 Office Professional 2016 Office Standard 2016
Office Home and Business 2016 Office Home and Student 2016
§Description: This security update resolves remote code execution and a spoofing vulnerability in
Microsoft Outlook. Neither can be exploited via the Preview Pane. This bulletin references KBs
5002620 and 5002621.
§Impact: Remote Code Execution, Spoofing
§Fixes 2 Vulnerabilities: CVE-2024-38020 and CVE-2024-38021 are not known to be exploited or
publicly disclosed.
§Restart Required: Requires application restart
§Known Issues: None reported
MS24-07-OFF: Security Updates for Microsoft Office12

26. Copyright © 2024 Ivanti. All rights reserved. 26
§Maximum Severity: Important
§Affected Products: Microsoft 365 Apps, Office 2019, and Office LTSC 2021
§Description: This security update resolves remote code execution and a spoofing vulnerability in
Microsoft Outlook. Neither can be exploited via the Preview Pane. Information on the security
updates is available at
https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates.
§Impact: Remote Code Execution, Spoofing
§Fixes 2 Vulnerabilities: CVE-2024-38020 and CVE-2024-38021 are not known to be exploited or
publicly disclosed.
§Restart Required: Requires application restart
§Known Issues: None reported
MS24-07-O365: Security Updates for Microsoft 365 Apps12

27. Copyright © 2024 Ivanti. All rights reserved. 27
MS24-07-MRNET: Monthly Rollup for Microsoft .NET12
§Maximum Severity: Important
§Affected Products: Microsoft Windows .Net Framework 2.0 SP2 through 4.8.1
§Description: This update fixes a vulnerability in the .NET framework whereby an attacker who
successfully exploited this vulnerability could gain SYSTEM privileges. This bulletin references
14 KB articles.
§Impact: Elevation of Privilege
§Fixes 1 Vulnerability: CVE-2024-38081
§Restart Required: Does not require a system restart after you apply it unless files that are being
updated are locked or are being used.
§Known Issues: None reported

28. Copyright © 2024 Ivanti. All rights reserved. 28
MS24-07-SONET: Monthly Rollup for Microsoft .NET2
§Maximum Severity: Important
§Affected Products: Microsoft Windows .Net Framework 2.0 SP2 through 4.8.1
§Description: This update fixes a vulnerability in the .NET framework whereby an attacker who
successfully exploited this vulnerability could gain SYSTEM privileges. This bulletin references
14 KB articles.
§Impact: Elevation of Privilege
§Fixes 1 Vulnerability: CVE-2024-38081
§Restart Required: Does not require a system restart after you apply it unless files that are being
updated are locked or are being used.
§Known Issues: None reported

29. Copyright © 2024 Ivanti. All rights reserved. 29
Between
Patch Tuesdays

30. Copyright © 2024 Ivanti. All rights reserved. 30
Windows Release Summary
§Security Updates (with CVEs): AutoCAD (1), Google Chrome (2), Ivanti Pulse Secure VPN Desktop
Client (1), Apache Tomcat (2)
§Security Updates (w/o CVEs): Adobe Acrobat DC and Acrobat Reader DC (2), CCleaner (2), Cisco
Webex Meetings Desktop App (1), Falcon Sensor for Windows (1), Docker For Windows (1), Dropbox
(1), Evernote (5), Firefox (2), Grammarly for Windows (3), HPE System Management Homepage (1),
Malwarebytes (1), Node.JS (Current) (1), Node.JS (LTS Upper) (1), Opera (3), Plex Media Server (1),
Recuva (1), Royal TS (2), Skype (2), Slack Machine-Wide Installer (2), Snagit (1), Splunk Universal
Forwarder (3), Tableau Desktop (7), Tableau Prep Builder (2), Tableau Reader (2), Thunderbird (2),
TeamViewer (1), WinSCP (1), Zoom Workplace Desktop App (2), Zoom Workplace VDI App (2)
§Non-Security Updates: 7-Zip (1), Amazon WorkSpaces (2), BlueBeam Revu (1), Box Drive (1),
Bitwarden (4), Camtasia (2), Cisco Webex Teams (1), draw.io (2), Evernote (1), Google Drive File
Stream (1), GoodSync (2), GeoGebra Classic (1), GoTo Connect (1), Ivanti Security Console (1),
KeePassXC (1), LogMeIn (2), NextCloud Desktop Client (1), PDF-Xchange PRO (1), R for Windows
(1), RingCentral App (Machine-Wide Installer) (3), RealVNC Server (1), RealVNC Viewer (1),

31. Copyright © 2024 Ivanti. All rights reserved. 31
Windows Third Party CVE Information
§AutoCAD 2024.1.5
§ADAC24-240625, QACAD202415
§Fixes 13 Vulnerabilities: CVE-2024-23150, CVE-2024-23151, CVE-2024-23152, CVE-2024-23153,
CVE-2024-23154, CVE-2024-23155, CVE-2024-23156, CVE-2024-23157, CVE-2024-23158,
CVE-2024-23159, CVE-2024-36999, CVE-2024-37005, CVE-2024-37007
§Google Chrome 126.0.6478.115
§CHROME-240618, QGC12606478115
§Fixes 4 Vulnerabilities: CVE-2024-6100, CVE-2024-6101, CVE-2024-6102, CVE-2024-6103
§Google Chrome 126.0.6478.127
§CHROME-240625, QGC12606478127
§Fixes 4 Vulnerabilities: CVE-2024-6290, CVE-2024-6291, CVE-2024-6292, CVE-2024-6293

32. Copyright © 2024 Ivanti. All rights reserved. 32
Windows Third Party CVE Information (cont)
§Ivanti Pulse Secure VPN Desktop Client 22.7.1.1.29163
§PSVPN-240625, QPSVPN227111
§Fixes 2 Vulnerabilities: CVE-2023-38042, CVE-2023-46810
§Apache Tomcat 10.1.25
§TMCAT101-240621, QTOMCAT10125
§Fixes 1 Vulnerability: CVE-2024-34750
§Apache Tomcat 9.0.90
§TMCAT90-240620, QTOMCAT9090
§Fixes 1 Vulnerability: CVE-2024-34750

33. Copyright © 2024 Ivanti. All rights reserved. 33
Apple Release Summary
§Security Updates (with CVEs): Google Chrome (2), Microsoft Edge (2), Thunderbird (1)
§Security Updates (w/o CVEs): Microsoft AutoUpdate (1), Zoom Client for Mac (1)
§Non-Security Updates: 7-Zip (1), Brave (3), Docker Desktop for Mac (1), draw.io (2), Dropbox
(2), Evernote (5), Firefox (2), Google Drive (1), Grammarly (3), HandBrake (1), IntelliJ IDEA
(1), Microsoft Edge (2), Obsidian for Mac (1), OneDrive for Mac (1), Microsoft Office 2019
Outlook (3), Microsoft Teams (Mac) (2), Parallels Desktop (1), PyCharm Professional (1),
Python (1), Slack (1), Spotify (2), Thunderbird (1), Visual Studio Code (2), Webex Teams for
Mac (1), Zoom Client (1)

34. Copyright © 2024 Ivanti. All rights reserved. 34
Apple Third Party CVE Information
§Google Chrome 126.0.6478.115
§CHROMEMAC-240620
§Fixes 4 Vulnerabilities: CVE-2024-6100, CVE-2024-6101, CVE-2024-6102, CVE-2024-6103
§Google Chrome 126.0.6478.127
§CHROMEMAC-240625
§Fixes 4 Vulnerabilities: CVE-2024-6290, CVE-2024-6291, CVE-2024-6292, CVE-2024-6293
§Thunderbird 115.12.1
§TB-240619
§Fixes 8 Vulnerabilities: CVE-2024-5688, CVE-2024-5690, CVE-2024-5691, CVE-2024-5692, CVE-
2024-5693, CVE-2024-5696, CVE-2024-5700, CVE-2024-5702

35. Copyright © 2024 Ivanti. All rights reserved. 35
Apple Third Party CVE Information (cont)
§Microsoft Edge 126.0.2592.68
§MEDGEMAC-240620
§Fixes 6 Vulnerabilities: CVE-2024-38082, CVE-2024-38093, CVE-2024-6100, CVE-2024-
6101, CVE-2024-6102, CVE-2024-6103
§Microsoft Edge 126.0.2592.81
§MEDGEMAC-240627
§Fixes 5 Vulnerabilities: CVE-2024-34122, CVE-2024-6290, CVE-2024-6291, CVE-2024-6292,
CVE-2024-6293

36. Copyright © 2024 Ivanti. All rights reserved. 36
Q & A

37. Copyright © 2024 Ivanti. All rights reserved.Copyright © 2024 Ivanti. All rights reserved. 37
Thank You!