JPCERT-AT-2024-0006
JPCERT/CC
2024-02-14

I. Overview

Microsoft has released February 2024 Security Updates to address the vulnerabilities in their products. Remote attackers leveraging these vulnerabilities may be able to execute arbitrary code. It is recommended to check the information provided by Microsoft and apply the updates.

Microsoft Corporation
February 2024 Security Updates
https://msrc.microsoft.com/update-guide/en-us/releaseNote/2024-Feb

Microsoft Corporation
Microsoft Security Updates for February 2024 (Monthly) (Japanese)
https://msrc.microsoft.com/blog/2024/02/202402-security-update/

According to Microsoft, among the vulnerabilities, the following vulnerabilities have been confirmed to be exploited in the wild. Please consider applying the security update programs by referring to the information provided by Microsoft.

CVE-2024-21351
Windows SmartScreen Security Feature Bypass Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351

CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412

Trend Micro has published a blog about attacks that exploit the vulnerability (CVE-2024-21412). The attack attempts to infect malware by inducing users to run a .url file that exploits the vulnerability on platform such as forex trading forums.

Trend Micro
CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html

II. Solution

Please apply the security update programs through Microsoft Update,Windows Update, etc. as soon as possible.

Microsoft Update Catalog
https://www.catalog.update.microsoft.com/

Windows Update: FAQ
https://support.microsoft.com/en-us/help/12373/windows-update-faq

III. References

Microsoft Corporation
Release Notes
https://msrc.microsoft.com/update-guide/releaseNote


If you have any information regarding this alert, please contact JPCERT/CC.

JPCERT Coordination Center (Early Warning Group)
MAIL: ew-info@jpcert.or.jp
https://www.jpcert.or.jp/english/