Подоспели майские апдейты от Microsoft, в этот раз включающие патчи для 61 уязвимости, две из которых активно используются в реальных кибератаках. Ещё для одной в Сети лежит готовый эксплойт.
Статус критической достался лишь одной бреши из набора — возможности удалённого выполнения кода в Microsoft SharePoint Server. По категориям проблемы в этот раз распределились следующим образом:
- 17 багов повышения прав;
- 2 проблемы обхода защитных функций;
- 27 уязвимостей удалённого выполнения кода;
- 7 дыр, приводящих к раскрытию информации;
- 3 возможности провести DoS;
- 4 бага, допускающих спуфинг.
Две уязвимости, закрытые в мае 2024 года, уже фигурируют в атаках киберпреступников, ещё одна имеет готовый общедоступный эксплойт.
- CVE-2024-30040 — обход защитных функций в Windows MSHTML. Атакующему придётся обманом заставить жертву загрузить вредоносный документ, при запуске которого злоумышленник сможет выполнить произвольный код в системе.
- CVE-2024-30051 — повышение прав, затрагивающее корневую библиотеку Windows DWM. Киберпреступник может получить привилегии уровня SYSTEM с помощью соответствующего эксплойта. Специалисты «Лаборатории Касперского» утверждают, что именно эта брешь используется в атаках Qakbot.
- CVE-2024-30046 — проблема отказа в обслуживании, затрагивающая Microsoft Visual Studio. Готовый эксплойт для этой дыры лежит в Сети, хотя в реальных атаках она пока замечена не была.
Полный список пропатченных уязвимостей выглядит так:
| Затронутый компонент | CVE-идентификатор | CVE-наименование | Степень риска |
| .NET and Visual Studio | CVE-2024-30045 | .NET and Visual Studio Remote Code Execution Vulnerability | Важная |
| Azure Migrate | CVE-2024-30053 | Azure Migrate Cross-Site Scripting Vulnerability | Важная |
| Microsoft Bing | CVE-2024-30041 | Microsoft Bing Search Spoofing Vulnerability | Важная |
| Microsoft Brokering File System | CVE-2024-30007 | Microsoft Brokering File System Elevation of Privilege Vulnerability | Важная |
| Microsoft Dynamics 365 Customer Insights | CVE-2024-30048 | Dynamics 365 Customer Insights Spoofing Vulnerability | Важная |
| Microsoft Dynamics 365 Customer Insights | CVE-2024-30047 | Dynamics 365 Customer Insights Spoofing Vulnerability | Важная |
| Microsoft Edge (Chromium-based) | CVE-2024-4558 | Chromium: CVE-2024-4558 Use after free in ANGLE | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2024-4331 | Chromium: CVE-2024-4331 Use after free in Picture In Picture | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2024-4671 | Chromium: CVE-2024-4671 Use after free in Visuals | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2024-30055 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | Низкая |
| Microsoft Edge (Chromium-based) | CVE-2024-4368 | Chromium: CVE-2024-4368 Use after free in Dawn | Неизвестно |
| Microsoft Edge (Chromium-based) | CVE-2024-4559 | Chromium: CVE-2024-4559 Heap buffer overfНизкая in WebAudio | Неизвестно |
| Microsoft Intune | CVE-2024-30059 | Microsoft Intune for Android Mobile Application Management Tampering Vulnerability | Важная |
| Microsoft Office Excel | CVE-2024-30042 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office SharePoint | CVE-2024-30044 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Критическая |
| Microsoft Office SharePoint | CVE-2024-30043 | Microsoft SharePoint Server Information Disclosure Vulnerability | Важная |
| Microsoft WDAC OLE DB provider for SQL | CVE-2024-30006 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | Важная |
| Microsoft Windows SCSI Class System File | CVE-2024-29994 | Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability | Важная |
| Microsoft Windows Search Component | CVE-2024-30033 | Windows Search Service Elevation of Privilege Vulnerability | Важная |
| Power BI | CVE-2024-30054 | Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability | Важная |
| Visual Studio | CVE-2024-30046 | Visual Studio Denial of Service Vulnerability | Важная |
| Visual Studio | CVE-2024-32004 | GitHub: CVE-2024-32004 Remote Code Execution while cloning special-crafted local repositories | Важная |
| Visual Studio | CVE-2024-32002 | CVE-2024-32002 Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution | Важная |
| Windows Cloud Files Mini Filter Driver | CVE-2024-30034 | Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability | Важная |
| Windows CNG Key Isolation Service | CVE-2024-30031 | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | Важная |
| Windows Common Log File System Driver | CVE-2024-29996 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Важная |
| Windows Common Log File System Driver | CVE-2024-30037 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Важная |
| Windows Common Log File System Driver | CVE-2024-30025 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Важная |
| Windows Cryptographic Services | CVE-2024-30020 | Windows Cryptographic Services Remote Code Execution Vulnerability | Важная |
| Windows Cryptographic Services | CVE-2024-30016 | Windows Cryptographic Services Information Disclosure Vulnerability | Важная |
| Windows Deployment Services | CVE-2024-30036 | Windows Deployment Services Information Disclosure Vulnerability | Важная |
| Windows DHCP Server | CVE-2024-30019 | DHCP Server Service Denial of Service Vulnerability | Важная |
| Windows DWM Core Library | CVE-2024-30008 | Windows DWM Core Library Information Disclosure Vulnerability | Важная |
| Windows DWM Core Library | CVE-2024-30051 | Windows DWM Core Library Elevation of Privilege Vulnerability | Важная |
| Windows DWM Core Library | CVE-2024-30035 | Windows DWM Core Library Elevation of Privilege Vulnerability | Важная |
| Windows DWM Core Library | CVE-2024-30032 | Windows DWM Core Library Elevation of Privilege Vulnerability | Важная |
| Windows Hyper-V | CVE-2024-30011 | Windows Hyper-V Denial of Service Vulnerability | Важная |
| Windows Hyper-V | CVE-2024-30017 | Windows Hyper-V Remote Code Execution Vulnerability | Важная |
| Windows Hyper-V | CVE-2024-30010 | Windows Hyper-V Remote Code Execution Vulnerability | Важная |
| Windows Kernel | CVE-2024-30018 | Windows Kernel Elevation of Privilege Vulnerability | Важная |
| Windows Mark of the Web (MOTW) | CVE-2024-30050 | Windows Mark of the Web Security Feature Bypass Vulnerability | Moderate |
| Windows Mobile Broadband | CVE-2024-30002 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-29997 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-30003 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-30012 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-29999 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-29998 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-30000 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-30005 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-30004 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-30021 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows Mobile Broadband | CVE-2024-30001 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Важная |
| Windows MSHTML Platform | CVE-2024-30040 | Windows MSHTML Platform Security Feature Bypass Vulnerability | Важная |
| Windows NTFS | CVE-2024-30027 | NTFS Elevation of Privilege Vulnerability | Важная |
| Windows Remote Access Connection Manager | CVE-2024-30039 | Windows Remote Access Connection Manager Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2024-30009 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2024-30024 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2024-30015 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2024-30029 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2024-30023 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2024-30014 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2024-30022 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Важная |
| Windows Task Scheduler | CVE-2024-26238 | Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability | Важная |
| Windows Win32K - GRFX | CVE-2024-30030 | Win32k Elevation of Privilege Vulnerability | Важная |
| Windows Win32K - ICOMP | CVE-2024-30038 | Win32k Elevation of Privilege Vulnerability | Важная |
| Windows Win32K - ICOMP | CVE-2024-30049 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | Важная |
| Windows Win32K - ICOMP | CVE-2024-30028 | Win32k Elevation of Privilege Vulnerability | Важная |