erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: August 13, 2024

1 editorial brief, 6 known exploited (cisa kev) additions and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Patch this week: Windows TCP/IP IPv6 Remote Code Execution (CVE-2024-38063). Admins of Windows or Windows Server machines with IPv6 enabled that have missed cumulative updates since August 2024, starting with hosts reachable over IPv6 from untrusted networks.
  • Do you run any of these? Microsoft Windows, Microsoft Project. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-09-03.
  • RubyGems: 1 critical advisory (sequenceserver). Check with bundle audit check --update.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2024-38063

Windows TCP/IP IPv6 Remote Code Execution (CVE-2024-38063)

Serious on paper and worth patching promptly, but there is no known in-the-wild exploitation, public code is a flaky crash-oriented proof of concept, and any machine on August 2024 or later cumulative updates is already fixed.

Must act: Admins of Windows or Windows Server machines with IPv6 enabled that have missed cumulative updates since August 2024, starting with hosts reachable over IPv6 from untrusted networks.

Can relax: Anyone whose Windows fleet takes monthly cumulative updates; there is no need to disable IPv6 as a reflex.

  1. Confirm every Windows host has an August 2024 or later cumulative update, and September 2024 or later for Windows 10 1809, Server 2019, Server 2022 and Windows 11 21H2
  2. Prioritize hosts reachable over IPv6 from the internet or untrusted segments
  3. Filter inbound IPv6 at the perimeter if you do not use it externally

Read the brief →

Known exploited (CISA KEV) 6

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2024-38213Microsoft Windows
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability		2024-09-03
CVE-2024-38193Microsoft Windows
Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability		2024-09-03
CVE-2024-38189Microsoft Project
Microsoft Project Remote Code Execution Vulnerability 		2024-09-03
CVE-2024-38178Microsoft Windows
Microsoft Windows Scripting Engine Memory Corruption Vulnerability		2024-09-03
CVE-2024-38107Microsoft Windows
Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability		2024-09-03
CVE-2024-38106Microsoft Windows
Microsoft Windows Kernel Privilege Escalation Vulnerability		2024-09-03

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

RubyGems 1

Check: bundle audit check --update