Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs

Today is Microsoft's March 2024 Patch Tuesday, and security updates have been released for 60 vulnerabilities, including eighteen remote code execution flaws.

This Patch Tuesday fixes only two critical vulnerabilities: Hyper-V remote code execution and denial of service flaws.

The number of bugs in each vulnerability category is listed below

24 Elevation of Privilege Vulnerabilities 3 Security Feature Bypass Vulnerabilities 18 Remote Code Execution Vulnerabilities 6 Information Disclosure Vulnerabilities 6 Denial of Service Vulnerabilities 2 Spoofing Vulnerabilities

The total count of 60 flaws does not include 4 Microsoft Edge flaws fixed on March 7th.

Furthermore, Microsoft did not disclose any zero-days as part of today's Patch Tuesday updates.

Flaws of interest

This month's Patch Tuesday does not fix any zero-day vulnerabilities but does include some interesting flaws, which we have listed below.

CVE-2024-26199 - Microsoft Office Elevation of Privilege Vulnerability

Microsoft has fixed a Office vulnerability allowing any authenticated user to gain SYSTEM privileges.

"Any authenticated user could trigger this vulnerability. It does not require admin or other elevated privileges," explains Microsoft.

The flaw was discovered by Iván Almuiña from Hacking Corporation Sàrl.

CVE-2024-20671 - Microsoft Defender Security Feature Bypass Vulnerability

Microsoft has fixed a Microsoft Defender vulnerability that could 

"An authenticated attacker who successfully exploited this vulnerability could prevent Microsoft Defender from starting," explains Microsoft.

However, this will be resolved by Windows Defender Antimalware Platform updates that are automatically installed on Windows devices.

This flaw is fixed in version 4.18.24010.12 of the Antimalware Platform.

Microsoft says that this flaw was discovered by Manuel Feifel with Infoguard (Vurex).

CVE-2024-21411 - Skype for Consumer Remote Code Execution Vulnerability

Microsoft has fixed a remote code execution vulnerability Skype for Consumer that can be triggered by a malicious link or image.

"An attacker could exploit the vulnerability by sending the user a malicious link or a malicious image via Instant Message and then convincing the user to click the link or image," explains Microsoft.

Microsoft says this flaw was discovered by Hector Peralta  and Nicole Armua working with Trend Micro Zero Day Initiative.

Recent updates from other companies

Other vendors who released updates or advisories in March 2024 include:

AnyCubic released new Kobra 2 firmware to fix a zero-day vulnerability exploited last month. Apple released security updates to fix two iOS zero-days. Cisco released security updates for multiple products. Fortinet released security updates for FortiOS & FortiProxy. Google released the Android March 2024 security updates. Intel released an advisory on a new Register File Data Sampling (RFDS) microarchitectural vulnerability. QNAP released security updates for an authentication bypass in QTS, QuTS hero, QuTScloud, and myQNAPcloud. SAP has released its March 2024 Patch Day updates. VMware released security updates to fix critical sandbox escape vulnerabilities in VMware ESXi, Workstation, Fusion, and Cloud Foundation.

The March 2024 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the March 2024 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.