August 29, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Multiple Palo Alto Networks Vulnerabilities
November 15, 2024
Bitter APT – Active IOCs
November 17, 2024
Multiple Palo Alto Networks Vulnerabilities
November 15, 2024
Bitter APT – Active IOCs
November 17, 2024
Severity
High
Analysis Summary
CVE-2024-43642 CVSS:7.5
Microsoft Windows is vulnerable to a denial of service, caused by a use-after-free in the SMB component. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-43641 CVSS:7.8
Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Registry component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to gain SYSTEM privileges.
CVE-2024-43640 CVSS:7.8
Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Kernel-Mode driver component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to gain SYSTEM privileges.
CVE-2024-43639 CVSS:9.8
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by an error in KDC Proxy. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-43635 CVSS:8.8
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the Telephony Server component. By persuading a victim to connect to a specially crafted server, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-43622 CVSS:8.8
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a heap-based buffer overflow in the Telephony Server component. By persuading a victim to connect to a specially crafted server, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-43620 CVSS:8.8
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a heap-based buffer overflow in the Telephony Server component. By persuading a victim to connect to a specially crafted server, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-49046 CVSS:7.8
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability.
Impact
- Denial of Service
- Privilege Escalation
- Code Execution
Indicators of Compromise
CVE
- CVE-2024-43642
- CVE-2024-43641
- CVE-2024-43640
- CVE-2024-43639
- CVE-2024-43635
- CVE-2024-43622
- CVE-2024-43620
- CVE-2024-49046
Affected Vendors
Microsoft
Affected Products
- Microsoft Windows Server 2022
- Microsoft Windows 10 Version 21H2 - 10.0.0
- Microsoft Windows 10 Version 22H2 - 10.0.0
- Microsoft Windows 11 version 22H2 - 10.0.0
- Microsoft Windows 11 version 22H3 - 10.0.0
- Microsoft Windows Server 2019 - 10.0.0
- Microsoft Windows Server 2008 Service Pack 2 - 6.0.0
- Microsoft Windows Server 2019 (Server Core installation) - 10.0.0
- Microsoft Windows Server 2022 - 10.0.0
- Microsoft Windows 11 Version 23H2 - 10.0.0
- Microsoft Windows Server 2008 R2 Service Pack 1 - 6.1.0
- Microsoft Windows Server 2012 R2 (Server Core installation) - 6.3.0
- Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) - 6.0.0
- Microsoft Windows Server 2012 R2 - 6.3.0
- Microsoft Windows Server 2025 - 10.0.0 - 10.0.0
- Microsoft Windows Server 2025 (Server Core installation) - 10.0.0 - 10.0.0
- Microsoft Windows 11 Version 24H2 - 10.0.0 - 10.0.0
Remediation
Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.