Only one critical vulnerability included in May’s Microsoft Patch Tuesday; One other zero-day in DWN Core

After a relatively hefty Microsoft Patch Tuesday in April, this month's security update from the company only included one critical vulnerability across its massive suite of products and services.

In all, May's slate of vulnerabilities disclosed by Microsoft included 59 total CVEs, most of which are considered to be of "important" severity. There is only one moderate-severity vulnerability.

The lone critical security issue is CVE-2024-30044, a remote code execution vulnerability in SharePoint Server. An authenticated attacker who obtains Site Owner permissions or higher could exploit this vulnerability by uploading a specially crafted file to the targeted SharePoint Server. Then, they must craft specialized API requests to trigger the deserialization of that file's parameters, potentially leading to remote code execution in the context of the SharePoint Server.

The Windows Mobile Broadband Driver also contains multiple remote code execution vulnerabilities:

• CVE-2024-29997
• CVE-2024-29998
• CVE-2024-29999
• CVE-2024-30000
• CVE-2024-30001
• CVE-2024-30002
• CVE-2024-30003
• CVE-2024-30004
• CVE-2024-30005

However, to successfully exploit this issue, an adversary would need to physically connect a compromised USB device to the victim's machine.

Microsoft also disclosed a zero-day vulnerability in the Windows DWM Core Library, CVE-2024-30051. Desktop Window Manager (DWM) is a Windows operating system service that enables visual effects on the desktop and manages things like transitions between windows.

An adversary could exploit CVE-2024-30051 to gain SYSTEM-level privileges.

This vulnerability is classified as having a "low" level of attack complexity, and exploitation of this vulnerability has already been detected in the wild.

One other issue, CVE-2024-30046, has already been disclosed prior to Patch Tuesday, but has not yet been exploited in the wild. This is a denial-of-service vulnerability in ASP.NET, a web application framework commonly used in Windows.

Microsoft considers this vulnerability "less likely" to be exploited, as successful exploitation would require an adversary to spend a significant amount of time repeating exploitation attempts by sending constant or intermittent data to the targeted machine.

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.

In response to these vulnerability disclosures, Talos is releasing a new Snort rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

The rules included in this release that protect against the exploitation of many of these vulnerabilities are 63419, 63420, 63422 - 63432, 63444 and 63445. There are also Snort 3 rules 300906 - 300912.