SB2024081389 - Multiple vulnerabilities in Microsoft Local Security Authority (LSA) Server

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Use of uninitialized resource (CVE-ID: CVE-2024-38118)

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Microsoft Local Security Authority (LSA) Server. A local user can pass specially crafted data to the application, trigger uninitialized usage of resources and gain access to sensitive information on the system.

2) Use of uninitialized resource (CVE-ID: CVE-2024-38122)

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Microsoft Local Security Authority (LSA) Server. A local user can pass specially crafted data to the application, trigger uninitialized usage of resources and gain access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-38118
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-38122