vulnerabilities
With November’s Patch Tuesday Microsoft fixed 89 vulnerabilities in its products — two of which are being actively exploited. One of them — CVE-2024-43451 — is particularly alarming. It allows attackers to gain access to the victim’s NTLMv2 hash. Although it doesn’t have an impressive CVSS 3.1 rating (only 6.5 / 6.0), its exploitation requires minimal interaction from the user, and it exists thanks to the MSHTML engine — the legacy of Internet Explorer — which is theoretically deactivated and no longer used. Nevertheless, all current versions of Windows are affected by this vulnerability.
Why is CVE-2024-43451 so dangerous?
CVE-2024-43451 allows an attacker to create a file that, once delivered to the victim’s computer, will give the attacker the possibility of stealing the NTLMv2 hash. NTLMv2 is a network authentication protocol used in Microsoft Windows environments. Having access to the NTLMv2 hash, an attacker can perform a pass-the-hash attack and attempt to authenticate on the network by posing as a legitimate user — without having their real credentials.
Of course, CVE-2024-43451 alone is not enough for a full-fledged attack — cybercriminals would have to use other vulnerabilities — but someone else’s NTLMv2 hash would make the attacker’s life much easier. At this point in time we have no additional information about scenarios that use CVE-2024-43451 in practice, but the vulnerability description clearly states that the vulnerability is publicly disclosed, and cases of exploitation have been detected in the wild.
What does “minimal interaction” mean?
It is generally assumed that if a user doesn’t open a malicious file — nothing bad can happen. In this case, that’s not true. According to the mini-FAQ in the security update guide advisory on CVE-2024-43451, exploitation may occur even when the user selects the file (single left-click), inspects it (with a right-click), or performs some “action other than opening or executing”.
What other vulnerabilities did Microsoft close in the November patch?
The second vulnerability that is already being exploited in real attacks is CVE-2024-49039. It allows attackers to escape from the AppContainer environment and, as a result, escalate their privileges to a Medium Integrity Level. In addition, there are two more holes that the company states are disclosed, although they’ve not yet been noticed in real attacks. These are CVE-2024-49019 in the Active Directory Certificate Service, which also allows the attacker to elevate privileges, and CVE-2024-49040 in Exchange, thanks to which malicious emails can be displayed with a fake sender address.
In addition, the critical vulnerability CVE-2024-43639, which allows remote code execution in Kerberos, also looks dangerous — though it only affects servers that are configured as a Kerberos Key Distribution Center (KDC) Proxy Protocol server.
How to stay safe?
In order to stay safe, we recommend, firstly, promptly installing updates for critical software (which, of course, includes the operating systems). In addition, it’s worth remembering that most attacks exploiting software vulnerabilities begin via email. Therefore, we recommend equipping all work devices with a reliable security solution, and not forget about protection at the mail gateway level.
Tips