May Patching Update: Spring Cleaning Your Security

Welcome to May’s edition of the OneNeck patching blog. As we transition deeper into spring, it’s crucial to stay vigilant in our cybersecurity efforts to ensure that exposures don’t replace May flowers. While Microsoft addressed fewer vulnerabilities than last month, they still tackled a significant array of issues. Additionally, our team observed numerous important updates within the Linux environment. 

Microsoft’s May Patching Security Overview

This month, Microsoft has addressed a total of 61 vulnerabilities, broken down into the following categories:

• 17 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 27 Remote Code Execution Vulnerabilities
• 7 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

This month’s patch release tackles multiple crucial vulnerabilities. Two zero-day vulnerabilities are notably patched, as well as a publicly disclosed vulnerability affecting .NET 7 & 8 alongside Visual Studio. The prompt resolution of these issues is critical in preserving the security integrity of systems, as they could allow attackers to exploit privileges or bypass security measures, leading to unauthorized access or data exposure.

Highlighted May Patching

This month’s critical updates include:

• CVE-2024-30040: Windows MSHTML Platform Security Feature Bypass Vulnerability
• CVE-2024-30051: Windows DWM Core Library Elevation of Privilege Vulnerability
• CVE-2024-30046: Visual Studio Denial of Service Vulnerability

Resolution of Known Issues from April 2024 Updates

Microsoft has resolved issues from last month’s updates, which predominantly affected VPN functionalities and NTLM authentication on Windows Servers. For more detailed insights, you can review the updates on the following blogs:

• Microsoft fixes VPN failures caused by April Windows updates
• Microsoft fixes Windows Server bug causing crashes, NTLM auth failures

Exchange Updates

Microsoft released a Hotfix for Exchange late last month to address the numerous known issues from the March Exchange Security Update. Fortunately, OneNeck’s customers were unaffected by these issues, so we will hold off on applying the Hotfix to customer Exchange Servers and wait for a future Security Update.

In the April Hotfix, Microsoft introduced support for ECC certificates and Hybrid Modern Authentication for OWA/ECP, available exclusively for Exchange Server 2019. The next Security or Cumulative Update for Exchange 2019 will also include these features.

Microsoft has recognized the need for DKIM and DMARC for Exchange Server On-Prem following the Q1 2024 announcement from Google and Yahoo. However, they do not have any updates to announce at this time. Customers routing their mail through MS365, rather than sending mail directly from their On-Prem Exchange Server, should be mostly unaffected by the changes from Google and Yahoo.

Additionally, Microsoft released an Exchange Server Roadmap Update this month, outlining their plans for Exchange Server SE (Subscription Edition). This edition will likely be released early in the third quarter of 2025, coinciding with the end-of-life date for Exchange Server 2016 and 2019. Exchange Server SE will be the code equivalent to Exchange Server 2019 CU15. OneNeck encourages all customers using Exchange to upgrade to Exchange Server 2019. If you have any questions about how OneNeck can assist you with your upgrade decisions, please contact the Service Desk.

Linux Patching Insights

This month’s Linux updates address various vulnerabilities crucial for maintaining the security and stability of your environments. Notable patches include:

• CVE-2023-50269: Security updates for Squid to bolster network management security.
• CVE-2023-50868: Updates for Bind and DHCP enhancing DNS and network configuration security across Red Hat and Oracle Linux.
• CVE-2024-1488: Security updates for Unbound on Oracle Linux to ensure robust DNS security.
• CVE-2024-31083: Tigervnc and X.org server security updates for Oracle Linux, essential for secure remote desktop and graphical server environments.
• CVE-2023-40551: Shim security updates enhancing boot loader integrity.
• CVE-2023-52425, CVE-2024-1394: Security and bug fix updates for Grafana and Grafana-PCP on Oracle Linux, crucial for maintaining performance monitoring tools.
• CVE-2024-21094: Java-11-Openjdk security update to maintain Java application security.
• CVE-2024-23213: Webkit2gtk3 security updates to enhance web content rendering security.
• CVE-2024-3019: Pcp security, bug fixes, and enhancement updates.
• CVE-2024-3864: Firefox security updates across multiple distributions, vital for secure web browsing.

The quick application of these patches is crucial in mitigating risks and maintaining a secure environment.

Microsoft Office & SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For insights on integrating these updates seamlessly into your security strategy or how OneNeck can support your efforts, do not hesitate to contact our Service Desk.

Closing Thoughts

As we move deeper into spring, it’s an ideal time to refresh and reinforce your cybersecurity measures by staying current with essential patching practices. As nature renews, let’s ensure our systems are fortified and secure. Timely and informed patch management is crucial in defending against vulnerabilities. If you have questions or need assistance, OneNeck is here to support your cybersecurity efforts.

Stay secure and patched, and let’s spring into action together.

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

 

Additional Resources: