* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Monday, September 8, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Monumental Sports & Entertainment Sets Corporate Direction at Nasdaq – PR Newswire

    Monumental Sports & Entertainment Reveals Bold New Corporate Vision at Nasdaq

    The Secret to What Made ‘CarJack’ Work on As the World Turns – yahoo.com

    The Surprising Secret Behind ‘CarJack’s’ Success on As the World Turns

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Pendulum Announce Homecoming 2026 Australian Tour – yahoo.com

    Pendulum Announces Thrilling Homecoming Tour Across Australia in 2026

    ITV Studios Launches New Entertainment Label – Global Bulletin – IMDb

    ITV Studios Unveils Exciting New Entertainment Label

    TS Entertainment bringing Malibu Jack’s to former Owensboro mall – Lane Report

    TS Entertainment Launches Malibu Jack’s at Former Owensboro Mall Location

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Industry partner provides Ferris State Plastics Engineering Technology students with state-of-the-art equipment to gain in-demand skills – Ferris State University

    Industry Partner Equips Ferris State Plastics Engineering Students with Cutting-Edge Technology to Boost In-Demand Skills

    Health Technology Ecosystem – Centers for Medicare & Medicaid Services | CMS (.gov)

    Discover the Future of Health Technology: Innovations Revolutionizing Patient Care

    Coherent Joins LLNL’s STARFIRE Diode Technology Working Group to Advance Inertial Fusion Energy – GlobeNewswire

    Coherent Partners with LLNL’s STARFIRE Team to Drive Breakthroughs in Inertial Fusion Energy

    Gene Associated With Deadly Heart Disease in Golden Retrievers Identified – Technology Networks

    Breakthrough Discovery Uncovers Gene Behind Deadly Heart Disease in Golden Retrievers

    Monkey Island LNG Picks ConocoPhillips’ Liquefaction Technology – Hart Energy

    Monkey Island LNG Selects ConocoPhillips’ Advanced Liquefaction Technology for Next-Gen Energy Solutions

    Credo Technology Group Holding Ltd. (CRDO) Surpasses Q1 Earnings and Revenue Estimates – Yahoo Finance

    Credo Technology Group Surpasses Q1 Earnings and Revenue Expectations

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Monumental Sports & Entertainment Sets Corporate Direction at Nasdaq – PR Newswire

    Monumental Sports & Entertainment Reveals Bold New Corporate Vision at Nasdaq

    The Secret to What Made ‘CarJack’ Work on As the World Turns – yahoo.com

    The Surprising Secret Behind ‘CarJack’s’ Success on As the World Turns

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Victor Garber on his viral “And Just Like That” toilet scene: ‘I was delighted to be doing something ridiculous’ (exclusive) – yahoo.com

    Pendulum Announce Homecoming 2026 Australian Tour – yahoo.com

    Pendulum Announces Thrilling Homecoming Tour Across Australia in 2026

    ITV Studios Launches New Entertainment Label – Global Bulletin – IMDb

    ITV Studios Unveils Exciting New Entertainment Label

    TS Entertainment bringing Malibu Jack’s to former Owensboro mall – Lane Report

    TS Entertainment Launches Malibu Jack’s at Former Owensboro Mall Location

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Industry partner provides Ferris State Plastics Engineering Technology students with state-of-the-art equipment to gain in-demand skills – Ferris State University

    Industry Partner Equips Ferris State Plastics Engineering Students with Cutting-Edge Technology to Boost In-Demand Skills

    Health Technology Ecosystem – Centers for Medicare & Medicaid Services | CMS (.gov)

    Discover the Future of Health Technology: Innovations Revolutionizing Patient Care

    Coherent Joins LLNL’s STARFIRE Diode Technology Working Group to Advance Inertial Fusion Energy – GlobeNewswire

    Coherent Partners with LLNL’s STARFIRE Team to Drive Breakthroughs in Inertial Fusion Energy

    Gene Associated With Deadly Heart Disease in Golden Retrievers Identified – Technology Networks

    Breakthrough Discovery Uncovers Gene Behind Deadly Heart Disease in Golden Retrievers

    Monkey Island LNG Picks ConocoPhillips’ Liquefaction Technology – Hart Energy

    Monkey Island LNG Selects ConocoPhillips’ Advanced Liquefaction Technology for Next-Gen Energy Solutions

    Credo Technology Group Holding Ltd. (CRDO) Surpasses Q1 Earnings and Revenue Estimates – Yahoo Finance

    Credo Technology Group Surpasses Q1 Earnings and Revenue Expectations

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

Microsoft patches two zero-days for Valentine’s Day

February 15, 2024
in Technology
Microsoft patches two zero-days for Valentine’s Day
Share on FacebookShare on Twitter

Two security feature bypasses impacting Microsoft SmartScreen are on the February Patch Tuesday docket, among more than 70 issues


Alex Scroxton

By

Alex Scroxton,
Security Editor

Published: 14 Feb 2024 14:00

Microsoft has patched two actively exploited zero-day vulnerabilities in its February Patch Tuesday – a pair of security feature bypasses affecting Internet Shortcut Files and Windows SmartScreen respectively – out of a total of just over 70 vulnerabilities disclosed in the second drop of 2024.

Among some of the more pressing issues this month are critical vulnerabilities in Microsoft Dynamics, Exchange Server, Office, and Windows Hyper-V and Pragmatic General Multicast, although none of these flaws are being used in the wild quite yet.

Water Hydra

The first of the two zero-days is tracked as CVE-2024-21412 and was found by Trend Micro researchers. It appears to be being used to target foreign exchange traders specifically by a group tracked as Water Hydra.

According to Trend Micro, the cyber criminal gang is leveraging CVE-2024-21412 as part of a wider attack chain in order to bypass SmartScreen and deliver a remote access trojan (RAT) called DarkMe, likely as a precursor to future attacks, possibly involving ransomware.

“CVE-2024-21412 represents a critical vulnerability characterised by sophisticated exploitation of the Microsoft Defender SmartScreen through a zero-day flaw,” explained Saeed Abbasi, product manager for vulnerability research at the Qualys Threat Research Unit.

“This vulnerability is exploited via a specially crafted file delivered through phishing tactics, which cleverly manipulates internet shortcuts and WebDAV components to bypass the displayed security checks.

“The exploitation requires user interaction, attackers must convince the targeted user to open a malicious file, highlighting the importance of user awareness alongside technical defences. The impact of this vulnerability is profound, compromising security and undermining trust in protective mechanisms like SmartScreen,” said Abbasi.

The second zero-day, tracked as CVE-2024-21351, is remarkably similar to the first in that ultimately, it impacts the SmartScreen service. In this case, however, it enables an attacker to get around the checks that it conducts for the so-called Mark-of-the-Web (MotW) that indicates whether a file can be trusted or not, and execute their own code.

“This bypass can occur with minimal user interaction, requiring only that a user opens a malicious file,” said Abbasi. “The impact of this exploit includes potential unauthorised access to data (some loss of confidentiality), severe manipulation or corruption of data (total loss of integrity), and partial disruption of system operations (some loss of availability).

“The significance of this vulnerability lies in its ability to undermine a crucial security defence against malware and phishing attacks, emphasising the urgency for users to update their systems to mitigate the risk.”

Critical vulns

The five critical vulnerabilities this month are, in CVE number order:

CVE-2024-20684, a denial of service (DoS) vulnerability in Windows Hyper-V;
CVE-2024-21357, a remote code execution (RCE) vulnerability in Windows Pragmatic General Multicast (PGM);
CVE-2024-21380, an information disclosure vulnerability in Microsoft Dynamics Business Central/NAV;
CVE-2024-21410, an elevation of privilege (EoP) vulnerability in Microsoft Exchange Server;
CVE-2024-21413, an RCE vulnerability in Microsoft Office.

Assessing this month’s critical vulnerabilities, security experts zoomed in on CVE-2024-21410 in Microsoft Exchange in particular. Kev Breen, senior director of threat research at Immersive Labs, said that it should be high on the list because while it is not marked as being actively exploited, it is much more likely to be exploited.

“This specific vulnerability is known as an NTLM relay or pass-the-hash attack and this style of attack is a favourite for threat actors as it allows them to impersonate users in the network,” he said.

“The way this vulnerability works is that if an attacker is able to collect your NTLM hash, they effectively have the encoded version of your password and can log in to the Exchange Server as you. Microsoft specifically calls out past vulnerabilities like the Outlook zero click exploit CVE-2023-35636 as one method attackers can gain access to this NTLM hash.”

“Financially motivated attackers will be quick to try and weaponise this as it allows for more convincing business email compromise attacks where they can intercept, read and send legitimate email on behalf of employees, for example, from the CEO or CFO,” he said.

Mike Walters, president and co-founder of Action1, drew attention to CVE-2024-21412 in Outlook, which carries a very high severity rating of 9.8 on the CVSS scale.

“Characterised by its network-based attack vector, the vulnerability requires no special privileges or user interaction for exploitation and could significantly impact confidentiality, integrity, and availability,” he said.

An attacker can exploit this vulnerability via the preview pane in Outlook, allowing them to circumvent Office Protected View and force files to open in edit mode, rather than in the safer protected mode,” said Walters.

Walters said that the threat posed by this vulnerability was substantial, possibly enabling an attacker to elevate their privileges and gain the ability to read, write and delete data. Added to this concern, it could also allow them to craft malicious links to bypass Protected View Protocol, leading to the exposure of local NTLM credentials and possibly facilitating remote code execution. As such, it should be treated as a priority.

Read more on Application security and coding requirements


February Patch Tuesday corrects two Windows zero-days

TomWalat

By: Tom Walat


CISA warns Fortinet zero-day vulnerability under attack

ArielleWaldman

By: Arielle Waldman


Ivanti discloses new zero-day flaw, releases delayed patches

ArielleWaldman

By: Arielle Waldman


Critical vulnerability exposes Fortra GoAnywhere users

AlexScroxton

By: Alex Scroxton

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : Computer Weekly – https://www.computerweekly.com/news/366569879/Microsoft-patches-two-zero-days-for-Valentines-Day

Tags: Microsoftpatchestechnology
Previous Post

Met Police to scrap and replace ‘racist’ Gangs Violence Matrix

Next Post

Southern Water customer data was taken in ransomware attack

Poland vs Finland: UEFA World Cup Qualifiers stats & head-to-head – BBC

Poland vs Finland: Key Stats and Head-to-Head Showdown in UEFA World Cup Qualifiers

September 8, 2025
Putin Ally Issues Dire Warning About Russian Economy – Newsweek

Putin Ally Issues Stark Warning About Russia’s Economic Future

September 8, 2025
Monumental Sports & Entertainment Sets Corporate Direction at Nasdaq – PR Newswire

Monumental Sports & Entertainment Reveals Bold New Corporate Vision at Nasdaq

September 8, 2025
Trump’s new law will limit payments to hospitals that treat low-income patients – Stateline

Trump’s New Law Targets Major Cuts to Payments for Hospitals Serving Low-Income Patients

September 8, 2025
WATCH: Trump says ‘we’re not going to war’ with Chicago after threatening city on social media – PBS

Trump Reassures: ‘We’re Not Going to War’ with Chicago Despite Earlier Social Media Threats

September 8, 2025
Six Acclaimed Artists Interpret Ecology and the Landscape for ‘Ground/work 2025’ – thisiscolossal.com

Six Acclaimed Artists Interpret Ecology and the Landscape for ‘Ground/work 2025’ – thisiscolossal.com

September 7, 2025
This Stanford computer science professor went to written exams 2 years ago because of AI. He says his students insisted on it – Fortune

Stanford Professor Returns to Written Exams After Students Demand It Amid AI Rise

September 7, 2025
Tiny thumbnails may be key for rodents’ global takeover – Science News

How Tiny Thumbnails Helped Rodents Conquer the Globe

September 7, 2025
$9 Million Stock & Warrant Deal: American Trust Leads Furniture Maker Nova LifeStyle’s Strategic Offering – Stock Titan

American Trust Fuels Nova LifeStyle’s Growth with $9 Million Stock and Warrant Investment

September 7, 2025
Industry partner provides Ferris State Plastics Engineering Technology students with state-of-the-art equipment to gain in-demand skills – Ferris State University

Industry Partner Equips Ferris State Plastics Engineering Students with Cutting-Edge Technology to Boost In-Demand Skills

September 7, 2025

Categories

Archives

September 2025
MTWTFSS
1234567
891011121314
15161718192021
22232425262728
2930 
« Aug    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (812)
  • Economy (830)
  • Entertainment (21,708)
  • General (16,915)
  • Health (9,872)
  • Lifestyle (843)
  • News (22,149)
  • People (832)
  • Politics (837)
  • Science (16,040)
  • Sports (21,329)
  • Technology (15,810)
  • World (812)

Recent News

Poland vs Finland: UEFA World Cup Qualifiers stats & head-to-head – BBC

Poland vs Finland: Key Stats and Head-to-Head Showdown in UEFA World Cup Qualifiers

September 8, 2025
Putin Ally Issues Dire Warning About Russian Economy – Newsweek

Putin Ally Issues Stark Warning About Russia’s Economic Future

September 8, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version