KLA68916 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, cause denial of service.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in Azure Science Virtual Machine (DSVM) can be exploited remotely to gain privileges.
2. An elevation of privilege vulnerability in Microsoft Azure File Sync can be exploited remotely to gain privileges.
3. An elevation of privilege vulnerability in Azure Monitor Agent can be exploited remotely to gain privileges.
4. A denial of service vulnerability in Azure Storage Movement Client Library can be exploited to cause denial of service.
5. An elevation of privilege vulnerability in Azure Identity Libraries and Microsoft Authentication Library can be exploited remotely to gain privileges.

Original advisories

CVE-2024-37325

CVE-2024-35253

CVE-2024-35254

CVE-2024-35252

CVE-2024-35255

Related products

Microsoft-Azure

.NET

CVE list

CVE-2024-35252 high

CVE-2024-35255 high

CVE-2024-37325 high

CVE-2024-35253 warning

CVE-2024-35254 high

KB list

5039814

5023058

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Azure File Sync v16.0Azure Identity Library for JavaScriptAzure Identity Library for C++Azure Storage Movement Client Library for .NETAzure Identity Library for PythonAzure Data Science Virtual Machines for LinuxAzure Identity Library for .NETMicrosoft Authentication Library (MSAL) for Node.jsAzure Identity Library for JavaMicrosoft Authentication Library (MSAL) for .NETAzure Monitor AgentAzure Identity Library for GoMicrosoft Authentication Library (MSAL) for JavaAzure File Sync v17.0Azure File Sync v18.0