Microsoft Patches Critical MSMQ Flaw

On Patch Tuesday, June 11, 2024, Microsoft fixed numerous flaws, including a remote code execution vulnerability in Microsoft Message Queuing (MSMQ) affecting various Windows and Windows Server versions, even those at end of life. No exploitation has been detected yet, but it’s likely only a matter of time.

Critical MSMQ RCE Vulnerability Fixed

In the second Patch Tuesday of July 2024, Microsoft fixed 51 vulnerabilities. Notably, a flaw in MSMQ with a CVSS rating of 9.8 affects many Windows and Windows Server versions, starting from Windows Server 2008.

CVE-2024-30080 exposes a vulnerability in the MSMQ server’s message handling process, allowing malicious actors to execute arbitrary code by manipulating memory during request handling. MSMQ is a Windows messaging protocol facilitating inter-application communication across networked machines. This flaw enables attackers to embed executable code within specially crafted messages, triggering its execution upon receipt by the MSMQ service.

Remote code execution vulnerabilities are particularly severe due to their wide-ranging impact. CVE-2024-30080 is especially concerning because of its ease of exploitation; adversaries can exploit it without authentication, potentially using it as an entry point. While no exploits are currently known, as mentioned earlier, they are expected to emerge, a possibility acknowledged by Microsoft.

MICROSOFT ADDRESSES CVE-2024-30080 WITH FIX

Following its disclosure during a Patch Tuesday release, Microsoft promptly issued a fix. This update covers all affected Windows versions, including those that have reached end of life. For consumer versions, support starts from Windows 10 1607, one of the earliest major updates to Windows 10.

For home users, the danger is minimal. MSMQ is an optional feature typically activated by system administrators during messaging system setup. It’s unlikely for home users to have this feature enabled by default. However, for those who use their office workstation at home without changing settings, MSMQ may still be present. Regardless, regularly installing Windows security updates remains good practice.