SB2024100858 - Multiple vulnerabilities in Microsoft Windows Mobile Broadband Driver
Published: October 8, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2024-43555)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in the Windows Mobile Broadband Driver. A remote attacker on the local network can trigger an out-of-bounds read error and cause a denial of service condition on the system.
2) Input validation error (CVE-ID: CVE-2024-43540)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
3) Input validation error (CVE-ID: CVE-2024-43561)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
4) Open redirect (CVE-ID: CVE-2024-43543)
The vulnerability allows a local attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data in Windows Mobile Broadband Driver. An attacker with physical access can plug in a malicious USB drive and execute arbitrary code on the target system.
5) Input validation error (CVE-ID: CVE-2024-43526)
The vulnerability allows a local attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. An attacker with physical access can plug in a malicious USB drive and execute arbitrary code on the target system.
6) NULL pointer dereference (CVE-ID: CVE-2024-43559)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted data to the application and perform a denial of service (DoS) attack.
7) Input validation error (CVE-ID: CVE-2024-43525)
The vulnerability allows a local attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. An attacker with physical access can plug in a malicious USB drive and execute arbitrary code on the target system.
8) Input validation error (CVE-ID: CVE-2024-43542)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
9) Input validation error (CVE-ID: CVE-2024-43538)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
10) Use of uninitialized resource (CVE-ID: CVE-2024-43537)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to usage of uninitialized resources in Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted data to the application, trigger uninitialized usage of resources and cause a denial of service condition on the target system.
11) Incorrect Access of Indexable Resource ('Range Error') (CVE-ID: CVE-2024-43524)
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to incorrect access of indexable resource. An attacker with physical access can plug in a malicious USB drive and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) Open redirect (CVE-ID: CVE-2024-43536)
The vulnerability allows a local attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data in Windows Mobile Broadband Driver. An attacker with physical access can plug in a malicious USB drive and execute arbitrary code on the target system.
13) Input validation error (CVE-ID: CVE-2024-43557)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
14) Input validation error (CVE-ID: CVE-2024-43558)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the Windows Mobile Broadband Driver. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.
15) Input validation error (CVE-ID: CVE-2024-43523)
The vulnerability allows a local attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Mobile Broadband Driver. An attacker with physical access can plug in a malicious USB drive and execute arbitrary code on the target system.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43555
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43540
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43561
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43543
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43526
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43559
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43525
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43542
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43538
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43537
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43524
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43536
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43557
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43558
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43523