CVE-2024-20655HighCVSS 6.6

Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability

Published
January 9, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2024-20655 →

📋 Description

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition.

According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability? To successfully exploit this vulnerability the attacker must be an authenticated user that is granted the "manage online responder" permission. This permission defines who can use the Online Responder snap-in to modify the configuration of the Online Responder, and should be granted very selectively.

🎯 Affected products17

  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022, 23H2 Edition (Server Core installation)

✅ Remediation

KB5034127 (Security Update) — fixed build 10.0.17763.5329 KB5034129 (Security Update) — fixed build 10.0.20348.2227 KB5034130 (Security Update) — fixed build 10.0.25398.643 KB5034119 (Security Update) — fixed build 10.0.14393.6614 KB5034173 (Monthly Rollup) — fixed build 6.0.6003.22464 KB5034176 (Security Only) — fixed build 6.0.6003.22464 KB5034169 (Monthly Rollup) — fixed build 6.1.7601.26910 KB5034167 (Security Only) — fixed build 6.1.7601.26910 KB5034184 (Monthly Rollup) — fixed build 6.2.9200.24664 KB5034171 (Monthly Rollup) — fixed build 6.3.9600.21765

🔗 References (21)