Critical Vulnerability in Microsoft’s June 2024 Patch Tuesday Update

On 11 June 2024, Microsoft published their June 2024 security update with patches for 49 vulnerabilities. Among these vulnerabilities, Arctic Wolf is highlighting CVE-2024-30080 as the highest severity vulnerability in this Patch Tuesday release which was categorised as critical. There has not been a proof of concept (PoC) exploit or active exploitation of CVE-2024-30080 identified at this time. 

Impacted Product: Windows 

Vulnerabilities Impacting Windows: 

Recommendations 

Recommendation #1: Apply Security Updates to Impacted Products 

Arctic Wolf strongly recommends applying the available security updates to all impacted products to prevent potential exploitation. 

Note: Please follow your organisations patching and testing guidelines to avoid operational impact. 

Recommendation #2: Disable Message Queuing Service (MSMQ) if not Required

To be vulnerable, CVE-2024-30080 requires the Message Queuing (MSMQ) service to be enabled. Consider disabling MSMQ if the service is not required in your environment to prevent exploitation. 

Note: You can check by looking for a service running named “Message Queuing” and for TCP port 1801 listening on the system. 

If disabling MSMQ is not feasible, consider blocking inbound connections to TCP port 1801 from suspicious sources. 

References 

• Microsoft Patch Tuesday (June 2024)

• CVE-2024-30080