US government warns users to patch this critical Microsoft Outlook bug

Date:
Fri, 07 Feb 2025 13:04:00 +0000

Description:
A critical Outlook flaw is being actively exploited to run code remotely.

FULL STORY ======================================================================
- CISA adds an Outlook improper input validation bug to KEV
- The deadline to patch is February 27 2025
- Criminals are using it for remote code execution

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a
2024 Outlook flaw to its catalog of known vulnerabilities, warning users
about in-the-wild abuse, and giving federal agencies three weeks (until February 27) to patch up or stop using the tool entirely.

CVE-2024-21413 is an improper input validation flaw plaguing Microsoft
Outlook. It was discovered in 2024 by Check Points researcher Haifei Li, and was given a severity score of 9.8/10 (critical). Cybercriminals could craft special email messages, loaded with a certain type of hyperlink, that would allow them to run arbitrary code remotely. By exploiting this vulnerability, attackers can bypass Outlook's Protected View (a feature designed to open potentially harmful files in read-only mode) and instead open malicious files in editing mode.

Microsoft patched the bug in late 2024, and warned users that the Preview
Pane can also be used as an attack vector. In other words, victims dont even need to open the email to get infected - previewing it in Outlook would suffice.

Significant risk

The vulnerability was found in different Office products, including Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, Microsoft Outlook 2016, and Microsoft Office 2019.

While there was no evidence of in-the-wild abuse at the time the patch was released, its addition to KEV means the vulnerability is now being actively used by miscreants.

"These types of vulnerabilities are frequent attack vectors for malicious
cyber actors and pose significant risks to the federal enterprise," CISA
says.

Aside from the Outlook vulnerability, the agency added another four bugs, including a 7-Zip Mark of the Web bypass flaw, a Dante discovery process control flaw, a CyberoamsOS SQL injection flaw, and a Sophos XG Firewall
buffer overflow bug. Federal agencies need to patch all of these before March 2025.

======================================================================
Link to news story: https://www.techradar.com/pro/security/us-government-warns-users-to-patch-this -critical-microsoft-outlook-bug

$$
--- SBBSecho 3.20-Linux
* Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)