July Patch Tuesday Unleashes a Torrent of Updates

With the information security industry’s two largest conferences (Black Hat Briefings and Def Con) set to happen in less than a month, Microsoft pulled out all the stops and, for July, nearly tripled the number of patches they released in June for problems discovered in Windows, Office, and software that runs under various server and cloud platforms.

The single product most prominently featured in the hot summer flood of fixes is Microsoft SQL Server. The Microsoft SQL Server Native Client component of this month’s update will fix 38 distinct remote code execution bugs in the OLE database driver. An attacker might invoke any of the bugs in the OLE DB driver by tricking an authenticated account into connecting to a malicious SQL Server database; The exploit happens when that malicious database returns data that triggers arbitrary code execution on the client.

Remote code execution bugs comprise the largest proportion of this month’s fixes, with the 59 RCEs making up more than 43% of the total number of problems this month’s cumulative update will resolve. Microsoft rates five of the RCE vulnerabilities at the highest severity level of “critical,” including bugs that affect SharePoint Server, Windows Remote Desktop Licensing Service, and the Windows Codec library.

July’s list of vulnerabilities includes 13 that Microsoft considers “more likely” exploitable than the rest, including the critical bugs in SharePoint Server and the Windows Codec library. Thankfully, Microsoft says only one of the bugs fixed this month have been exploited or have been made public – CVE-2024-38080, a privilege escalation exploit in the Windows Hyper-V hypervisor for virtual machines. Six of this month’s bugs are detectable through Sophos IPS rules in the XGS Firewall; Information about these are included in a table at the end of this article.

While the majority of these vulnerabilities were reported directly to Microsoft, some of the bug reports originated with outside organizations, who responsibly disclosed the information to Microsoft. Adobe reported CVE-2024-34122, an as-yet unexploited remote code execution vulnerability in the Chromium version of the Edge browser that was fixed prior to Patch Tuesday with the release of version 126.0.2592.81 on June 27. The CERT/CC at Carnegie Mellon University reported CVE-2024-3596, a forgery vulnerability that affects many operating systems’ implementation of the RADIUS protocol (RFC 2865) over UDP. Finally, Intel reported CVE-2024-37985, a weakness in the ARM processor family that, for Microsoft customers, only affects computers running Windows 11 version 22H2 on a 64-bit ARM (ARM64) CPU.

By the numbers

• Total Microsoft CVEs: 138
• Total Edge / Chrome advisory issues covered in update: 1
• Total non- Microsoft advisory issues covered in update: 4
• Total Adobe issues covered in update: 1
• Publicly disclosed: 1
• Exploited: 1
• Severity
  • Critical: 5
  • Important: 132
  • Moderate: 1
• Impact:
  • Remote Code Execution: 59
  • Elevation of Privilege: 24
  • Security Feature Bypass: 24
  • Denial of Service: 17
  • Information Disclosure: 8
  • Spoofing: 7

Products

• Windows (including .NET and ASP.NET): 87
• Microsoft SQL Server: 38
• Azure: 5
• SharePoint: 4
• Office: 2
• Dynamics 365: 1
• Microsoft Defender for IoT: 1

Notable July updates

In addition to the issues discussed above, a few specific items merit attention.

Microsoft SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

Microsoft ticks off 38 CVEs this month in fixes to its mature database family. There are too many CVE numbers to list them all here, but the patches all seem to address various permutations of the same general exploit process: If an attacker tricks an authenticated user of a legitimate MS-SQL database server into connecting to their malicious MS-SQL Server, arbitrary code on this malicious server would then propagate back up from the server to the client computer, and execute on the client.

The convoluted exploit requires that the hypothetical attackers do some work in advance, building out a database server that contains malicious content inside its tables. And, of course, it requires the targeted user not to have updated their SQL Server client software with this month’s cumulative update, and that the attackers identify and target a database admin, and successfully social-engineer them. Don’t be that unicorn.

CVE-2024-38060 – Microsoft Windows Codecs Library Remote Code Execution Vulnerability

In the year 1986, the world was introduced to a pair of cowboy fighter pilots (ahem, naval aviators) in Top Gun. Less well known, but still Alive And Kicking (like the song released the same year by Simple Minds), the TIFF image file format also was introduced that year by Aldus Corporation, now known as Adobe.

This CVE addresses a critical, easily exploitable vulnerability specific to this 38-year-old file format. A specially-crafted, malicious TIFF file, uploaded to a vulnerable server, could have triggered the server that receives the file to execute malicious code embedded in the TIFF file. Patch your servers to take them out of the danger zone.

CVE-2024-38032 – Microsoft Xbox Remote Code Execution Vulnerability

Users of the Xbox gaming console who also happen to have a wireless adapter, and connect wirelessly to their local network, should beware of strangers lurking on their network who can attack these devices. The (so far) hypothetical threat is that someone who is connected to your wireless network can send a malicious network packet to the Xbox, one that could execute an arbitrary command. The attacker has to be connected to the same network as the Xbox, so it’s another good reason not to invite any threat actors to your WLAN party.

Sophos protections

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Microsoft Update Catalog website. Run the winver.exe tool to determine which build of Windows you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of July patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE.

Denial of Service (17 CVEs)

Elevation of Privileges (24 CVEs)

Information Disclosure (9 CVEs)

Remote Code Execution (59 CVEs)

Security Feature Bypass (24 CVEs)

Spoofing (7 CVEs)

Appendix B: Exploitability

This is a list of the July CVEs judged by Microsoft to be more likely to be exploited in the wild within the first 30 days post-release. This month’s updates do not address any vulnerabilities Microsoft knows are being exploited.

Appendix C: Products Affected

This is a list of July’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family.

Windows (86 CVEs)

SQL Server (38 CVEs)

Azure (5 CVEs)

SharePoint (4 CVEs)

Office 365 (2 CVEs)

Microsoft Dynamics 365 (on-prem)

Microsoft Defender for IoT (1 CVE)