Microsoft Releases June 2024 Patch Tuesday Updates

Key Takeaways:

• Microsoft has patched a critical flaw in Microsoft Message Queuing (MSMQ) that allows an attacker to take over a vulnerable system.
• Microsoft also fixed a vulnerability in Microsoft Outlook that could be exploited via the email preview pane.
• The KB5039212 update for Windows 11 versions 22H2 and 23H2 introduced improvements to the Windows Share menu.

Microsoft released yesterday the June 2024 Patch Tuesday updates for Windows 11 and Windows 10 devices. This month, the company has released security patches to address 49 vulnerabilities in Windows, Office, and other components.

On the quality and experiences update front, Microsoft has released a couple of improvements for the Windows Share menu in Windows 11 versions 22H2 and 23H2. The company has also introduced a new Snipping tool feature on Windows 10.

49 vulnerabilities fixed with the June 2024 Patch Tuesday updates

As pointed out by the Zero Day Initiative, Microsoft has addressed 49 vulnerabilities, including a critical flaw in Microsoft Message Queuing (MSMQ) technology. Here’s a list of the most important vulnerabilities Microsoft fixed this month.

• CVE-2024-30080: This is a critical remote code execution (RCE) vulnerability in Microsoft Message Queuing (MSMQ) with a CVSS score of 9.8. MSMQ is a synchronous messaging feature used to deliver and read messages from queues in Windows. This flaw could allow an unauthenticated hacker to completely take over a vulnerable Windows system by sending a specially crafted malicious MSMQ packet. It affects all versions of Windows, including Windows 10 and Windows Server 2008.
• CVE-2023-50868: This is a denial-of-service (DoS) vulnerability in Windows Server with a CVSS rating of 7.5. It could allow hackers to exhaust CPU resources and disrupt the DNS resolution process on a vulnerable system, preventing users from accessing websites and online services.
• CVE-2024-30070: This Dynamic Host Configuration Protocol (DHCP) Server denial-of-service vulnerability affects Windows machines. Cybercriminals could exploit it to automatically assign IP addresses to network devices.
• CVE-2024-30103: This remote code execution vulnerability in Microsoft Outlook has a CVSS score of 8.8. An attacker can trigger it via the email Preview Pane, bypassing Outlook registry block lists and creating malicious DLL files to target the victim.
• CVE-2024-30099: This elevation-of-privilege (EoP) vulnerability in the Windows Kernel Driver could allow hackers to hijack an affected system.
• CVE-2024-30089: This vulnerability in Microsoft Streaming Services lets threat actors gain system-level privileges. However, Microsoft noted that this security flaw is harder to exploit.

You can find the full list of security patches Microsoft released this month below:

Quality and experience updates

Microsoft has released the KB5039212 update for users running Windows 11 versions 23H2 and 22H2. The Windows Share menu now lets users create QR codes for sharing web pages and cloud files in Microsoft Edge. Moreover, users can sign in with their Microsoft account in the Windows Backup app to back up files, settings, themes, Wi-Fi information, and installed apps.

Additionally, the KB5039213 brings a couple of bug fixes for Windows 11 version 21H2. This release also enables the SMB over QUIC client certificate authentication feature that lets IT admins restrict which client devices can access SMB over QUIC servers.

For Windows 10 version 22H2, Microsoft has started rolling out a new Snipping tool feature that allows users to edit the picture taken on their Android phones on Windows devices.

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary as hackers start to work out how to weaponize newly reported vulnerabilities.

A best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.