In Microsoft’s June Patch Tuesday update, a critical remote code execution (RCE) vulnerability in Microsoft Message Queuing (MSMQ) was identified as the most serious issue. Tracked as CVE-2024-30080 and discovered by Chinese researcher k0shl, this flaw allows a remote, unauthenticated attacker to execute arbitrary code with elevated privileges by sending a specially-crafted malicious packet to an MSMQ server.
Microsoft advises users to disable the MSMQ service if it is not necessary, as the vulnerability is only exploitable when the service is enabled. Tyler Reguly, Fortra’s associate director of security research and development, emphasized the importance of addressing CVE-2024-30080 promptly due to its high CVSS score of 9.8 and likelihood of exploitation.
Furthermore, another noteworthy vulnerability CVE-2023-50868 affecting the Domain Name System Security Extensions (DNSSEC) feature of DNS was disclosed by German researchers. This flaw can allow a malicious actor to conduct denial of service attacks by exploiting excessive resources on a resolver.
Overall, the June update includes several vulnerabilities, with five DoS vulnerabilities, 25 elevation of privilege (EoP) vulnerabilities, three information disclosure vulnerabilities, and 18 RCE vulnerabilities. Security experts recommend installing the necessary updates promptly to address these critical issues effectively.