CVE-2024-37968

Insufficient Verification of Data Authenticity (CWE-345)

Published: Aug 13, 2024

010
CVSS 7.5EPSS 0.09%High
CVE info copied to clipboard

Summary

Windows DNS Spoofing Vulnerability. This is a vulnerability in Windows DNS that allows for DNS spoofing attacks. It has a CVSS v3.1 base score of 7.5, indicating a high severity. The vulnerability is characterized by low attack complexity, no privileges required, and no user interaction needed. It can be exploited over the network and impacts confidentiality, but not integrity or availability.

Impact

This vulnerability could allow an attacker to perform DNS spoofing attacks, potentially redirecting network traffic to malicious sites. The high confidentiality impact suggests that sensitive information could be exposed. Given the nature of DNS, this could affect a wide range of services and applications that rely on DNS for name resolution. It could lead to data theft, phishing attacks, or serve as a stepping stone for further network compromise.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

Patches are available. Microsoft released updates to address this vulnerability on August 13, 2024. The vulnerability affects multiple versions of Windows Server, including Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2. Specific version numbers that need patching include: - Windows Server 2008 R2 SP1 and SP2 - Windows Server 2022 23H2 versions prior to 10.0.25398.1085 - Windows Server 2016 versions prior to 10.0.14393.7259 - Windows Server 2012 and 2012 R2 - Windows Server 2022 versions prior to 10.0.20348.2655 - Windows Server 2019 versions prior to 10.0.17763.6189

Mitigation

1. Apply the security updates provided by Microsoft as soon as possible, prioritizing internet-facing systems. 2. If immediate patching is not possible, consider implementing network segmentation to limit the potential impact of DNS spoofing attacks. 3. Monitor DNS traffic for unusual patterns or unexpected redirections. 4. Implement DNSSEC (Domain Name System Security Extensions) where possible to add an additional layer of authentication to DNS queries. 5. Educate users about the risks of phishing and the importance of verifying website authenticity. 6. Consider using alternative DNS providers or services that offer additional security features as a temporary measure until patching is complete.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (92160)

Aug 13, 2024 at 7:53 AM
CVSS

A CVSS base score of 7.5 has been assigned.

Aug 13, 2024 at 5:35 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-37968. See article

Aug 13, 2024 at 5:37 PM / Microsoft Security Advisories - MSRC
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Aug 13, 2024 at 5:38 PM
CVE Assignment

NVD published the first details for CVE-2024-37968

Aug 13, 2024 at 6:15 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Aug 13, 2024 at 6:43 PM
EPSS

EPSS Score was set to: 0.2% (Percentile: 58.6%)

Nov 19, 2024 at 3:51 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/windows_server_2016
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1495: Firmware Corruption
+null more

Attack Patterns

CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
+null more

References

August 13, 2024—KB5041851 (Monthly Rollup) - Microsoft Support
For more information, see Windows Server End of Support: Key Dates . After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.
Microsoft August 2024 Security Updates
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.8, CVEs: CVE-2024-21302, CVE-2024-29995, CVE-2024-37968, CVE-2024-38063, CVE-2024-38084, CVE-2024-38098, CVE-2024-38106, CVE-2024-38107, CVE-2024-38108, CVE-2024-38109, CVE-2024-38114, CVE-2024-38115, CVE-2024-38116, CVE-2024-38117, CVE-2024-38118, CVE-2024-38120, CVE-2024-38121, CVE-2024-38122, CVE-2024-38123, CVE-2024-38125 (+82 other associated CVEs), Summary: https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2024-patch-tuesday-fixes-9-zero-days-6-exploited/ Today is Microsoft's August 2024 Patch Tuesday, which includes security updates for 89 flaws, including six actively exploited and three publicly disclosed zero-days. Microsoft is still working on an update for a tenth publicly disclosed zero-day. This Patch Tuesday fixed eight critical vulnerabilities, which were a mixture of elevation of privileges, remote code execution, and information disclosure. The number of bugs in each vulnerability category is listed below:
August 13, 2024—KB5041828 (Monthly Rollup) - Microsoft Support
Windows 8.1 reached the end of support (EOS) on January 10, 2023, at which point technical assistance and software updates are no longer provided. For more information, see Windows Server End of Support: Key Dates .
See 5 more references

News

Windows 11 Insider Preview Build 26120.1843 (Dev Channel) released
The preview includes new features like shared material in File Explorer Home, the Windows Sandbox Client Preview, and a new account manager. For new PCs or new user accounts on managed commercial devices (PCs running Windows 11 Enterprise, Education, or Pro logged in with an Entra ID (or domain), the Microsoft 365 app will be pinned to the taskbar for quick access to Copilot for Microsoft 365 .
Windows 11 Build 26120.1843 (Dev) adds a prominent Sign out option to Start
To use this feature, simply open the File Explorer home page and click the Share tab. Based on feedback, Microsoft has made changes to the new account manager in the Start menu, bringing the Sign Out button back into the foreground, which should make it easier to sign out.
Windows 11: Disponibile una nuova build per gli Insider | Beta e Dev Channel
For new PCs or new user accounts on managed commercial devices (PCs running Windows 11 Enterprise, Education, or Pro logged in with an Entra ID (or domain), the Microsoft 365 app will be pinned to the taskbar for quick access to Copilot for Microsoft 365 . Based on feedback, we’ve made some updates to the new account manager on the Start menu making the sign out option directly visible, and adding a list of signed in users under “…” so it’s faster to switch accounts.
Announcing Windows 11 Insider Preview Build 26120.1843 (Dev Channel)
[caption id="attachment_177309" align="alignnone" width="628"] Windows Sandbox Client Preview with new dropdown showing clipboard redirection, audio/video input control, and the ability to share folders with the host.[/caption] Changes in Dev Channel builds and updates are documented in two buckets: new features, improvements, and fixes that are being gradually rolled out for Insiders who have turned on the toggle to get the latest updates as they are available (via Settings > Windows Update)* and then new features, improvements, and fixes rolling out to everyone in the Dev Channel.
KB5043185: Microsoft adds media controls to Windows lock screen, improves account switching
The new build, Build 26120.1843 under KB5043185, brings multiple new changes and improvements like new media controls on the lock screen, access to Shared content in File Explorer Home, Account Manager switching improvements, and more. For new PCs or new user accounts on managed commercial devices (PCs running Windows 11 Enterprise, Education, or Pro logged in with an Entra ID (or domain), the Microsoft 365 app will be pinned to the taskbar for quick access to Copilot for Microsoft 365 .
See 53 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI