Full Report
Today is Microsoft's January 2025 Patch Tuesday, which includes security updates for 159 flaws, including eight zero-day vulnerabilities, with three actively exploited in attacks. [...]
Analysis Summary
# Vulnerability: Microsoft January 2025 Patch Tuesday Summary
## CVE Details
- CVE ID: Multiple (Highlights below)
- CVSS Score: Varies (Includes **Critical** vulnerabilities)
- CWE: Varies (Includes RCE, EoP, Information Disclosure)
## Affected Systems
- Products: Windows (various components including Hyper-V, App Package Installer, Themes), .NET, Visual Studio, Active Directory Domain Services, Azure Marketplace SaaS Resources, Microsoft Access.
- Versions: Not specified in detail, but relates to systems running vulnerable versions of the listed Microsoft products prior to patching.
- Configurations: Specific configurations mentioned for Windows Themes (NTLM usage).
## Vulnerability Description
Microsoft's January 2025 Patch Tuesday addresses 159 flaws, including 8 zero-days, 3 of which are actively exploited. Key findings include:
1. **Windows Hyper-V EoP (3 flaws)**: Three sequential elevation of privilege vulnerabilities in Windows Hyper-V that allow attackers to gain **SYSTEM** privileges. These were actively exploited.
2. **CVE-2025-21275 (Windows App Package Installer EoP)**: Allows an attacker to gain **SYSTEM** privileges.
3. **Windows Themes Spoofing Vulnerability (Related to CVE-2024-38030)**: Exploited when a user views a specially crafted Theme file in Windows Explorer. This causes the system to send the logged-in user's NTLM credentials to a remote host if the Theme file specifies a network path for `BrandImage` or `Wallpaper`. NTLM hashes can then be cracked or used in pass-the-hash attacks.
4. **Microsoft Access RCE (3 flaws)**: Three remote code execution vulnerabilities triggered by opening specially crafted Microsoft Access documents.
5. **Critical Vulnerabilities**: The overall release includes 12 Critical vulnerabilities such as Information Disclosure, Privilege Elevation, and Remote Code Execution.
## Exploitation
- Status: **Three zero-day vulnerabilities are actively exploited in the wild.** PoC/exploitation details are known for the Windows Themes credential leakage flaw.
- Complexity: Varies (Low to Medium based on specific vulnerability, e.g., viewing a specialized file for the Themes flaw).
- Attack Vector: Varies (Network, Local).
## Impact
- Confidentiality: High (Credential theft via NTLM, Information Disclosure)
- Integrity: High (Privilege Escalation, RCE)
- Availability: Medium (Denial of Service vulnerabilities noted)
## Remediation
### Patches
Patches are available via the January 2025 cumulative updates for Windows 11, Windows 10, and associated software (.NET, Visual Studio). Specific patches resolve:
* CVE-2025-21275
* CVE-2025-21380 (Critical, Azure Marketplace)
* CVE-2025-21296 (Critical, BranchCache RCE)
* Patches for the three actively exploited Hyper-V EoP flaws.
### Workarounds
* **For Windows Themes NTLM Credential Leakage:**
* Disable NTLM entirely.
* Enable the Group Policy: "**Restrict NTLM: Outgoing NTLM traffic to remote servers**".
* **For Microsoft Access RCE:** Microsoft has mitigated these flaws by blocking access to the affected documents if they were delivered via email.
## Detection
- **Indicators of Compromise (IoCs)**: Unknown specific IoCs for the actively exploited Hyper-V vulnerabilities were provided in the summary. Detection should focus on lateral movement attempts or unexpected privilege gains adjacent to Hyper-V components.
- **Detection Methods and Tools**: Standard security monitoring for exploitation attempts related to file parsing or application services should be prioritized, especially monitoring for NTLM authentication attempts initiated by Explorer or related processes loading local/network theme files.
## References
- Vendor Advisories: Microsoft January 2025 Security Update Guide.
- Relevant Links:
- Reference for Windows 11 updates: hxxps://www.bleepingcomputer.com/news/microsoft/windows-11-kb5050009-and-kb5050021-cumulative-updates-released/
- Full vulnerability report link (external): hxxps://www.bleepingcomputer.com/microsoft-patch-tuesday-reports/Microsoft-Patch-Tuesday-January-2025.html