Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

In the present day is Microsoft’s September 2024 Patch Tuesday, which incorporates safety updates for 79 flaws, together with three actively exploited and one publicly disclosed zero-days.

This Patch Tuesday fastened seven important vulnerabilities, which have been both distant code execution or elevation of privileges flaws.

The variety of bugs in every vulnerability class is listed under:

• 30 Elevation of Privilege Vulnerabilities
• 4 Safety Function Bypass Vulnerabilities
• 23 Distant Code Execution Vulnerabilities
• 11 Info Disclosure Vulnerabilities
• 8 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

To be taught extra in regards to the non-security updates launched at the moment, you’ll be able to overview our devoted articles on the brand new Home windows 11 KB5043076 cumulative replace and Home windows 10 KB5043064 replace.

4 zero-days disclosed

This month’s Patch Tuesday fixes three actively exploited, certainly one of which was publicly disclosed, and one other that reintroduces outdated CVEs so is marked as exploited.

Microsoft classifies a zero-day flaw as one that’s publicly disclosed or actively exploited whereas no official repair is out there.

The three actively exploited zero-day vulnerabilities in at the moment’s updates are:

CVE-2024-38014 – Home windows Installer Elevation of Privilege Vulnerability

This vulnerability permits assaults to achieve SYSTEM privileges on Home windows techniques.

Microsoft has not shared any particulars on the way it was exploited in assaults.

The flaw was found by Michael Baer with SEC Seek the advice of Vulnerability Lab. 

CVE-2024-38217 – Home windows Mark of the Net Safety Function Bypass Vulnerability

This flaw was publicly disclosed final month by Joe Desimone of Elastic Safety and is believed to have been actively exploited since 2018.

Within the report, Desimone outlined a method referred to as LNK stomping that permits specifically crafted LNK information with non-standard goal paths or inside constructions to trigger the file to be opened whereas bypassing Sensible App Management and the Mark of the Net safety warnings.

“An attacker can craft a malicious file that will evade Mark of the Net (MOTW) defenses, leading to a restricted lack of integrity and availability of safety features akin to SmartScreen Utility Fame safety examine and/or the legacy Home windows Attachment Companies safety immediate,” explains Microsoft’s advisory.

When exploited, it causes the command within the LNK file to be executed with out a warning, as demonstrated on this video.

CVE-2024-38226 – Microsoft Writer Safety Function Bypass Vulnerability

Microsoft fastened a Microsoft Writer flaw that bypasses the safety protections in opposition to embedded macros in downloaded paperwork.

“An attacker who efficiently exploited this vulnerability may bypass Workplace macro insurance policies used to dam untrusted or malicious information,” explains Microsoft’s advisory.

Microsoft has not shared who disclosed the flaw and the way it was exploited.

Microsoft additionally fastened a zero-day that’s marked as exploited, however was achieved in order it may possibly reintroduce older exploited flaws, as defined under.

CVE-2024-43491 – Microsoft Home windows Replace Distant Code Execution Vulnerability

Microsoft fastened a servicing stack flaw that’s marked as distant code execution, however truly reintroduces a wide range of vulnerabilities to beforehand patched applications.

“Microsoft is conscious of a vulnerability in Servicing Stack that has rolled again the fixes for some vulnerabilities affecting Non-obligatory Elements on Home windows 10, model 1507 (preliminary model launched July 2015),” explains Microsoft’s advisory.

“Because of this an attacker may exploit these beforehand mitigated vulnerabilities on Home windows 10, model 1507 (Home windows 10 Enterprise 2015 LTSB and Home windows 10 IoT Enterprise 2015 LTSB) techniques which have put in the Home windows safety replace launched on March 12, 2024—KB5035858 (OS Construct 10240.20526) or different updates launched till August 2024. All later variations of Home windows 10 are usually not impacted by this vulnerability.”

“This servicing stack vulnerability is addressed by putting in the September 2024 Servicing stack replace (SSU KB5043936) AND the September 2024 Home windows safety replace (KB5043083), in that order.”

This flaw solely impacts Home windows 10, model 1507, which reached the tip of life in 2017. Nevertheless, it additionally impacts Home windows 10 Enterprise 2015 LTSB and Home windows 10 IoT Enterprise 2015 LTSB editions, that are nonetheless underneath assist.

This flaw is fascinating as a result of it triggered Non-obligatory Elements, akin to Lively Listing Light-weight Listing Companies, XPS Viewer, Web Explorer 11, LPD Print Service, IIS, and Home windows Media Participant to roll again to their authentic RTM variations.

This triggered any earlier CVE to be reintroduced into this system, which may then be exploited.

Microsoft marked this flaw as exploited as a result of its reintroduced vulnerabilities which have been actively exploited up to now. Nevertheless, Microsoft says the flaw itself was found internally by Microsoft and it has seen no proof that it’s publicly recognized by others.

Extra particulars in regards to the flaw and the whole record of affected elements can present in Microsoft’s advisory.

Current updates from different firms

Different distributors who launched updates or advisories in September 2024 embody:

The September 2024 Patch Tuesday Safety Updates

Under is the whole record of resolved vulnerabilities within the September 2024 Patch Tuesday updates.

To entry the complete description of every vulnerability and the techniques it impacts, you’ll be able to view the full report right here.

Replace 9/11/24: Up to date to clarify that solely three flaws have been actively exploited and why CVE-2024-43491 was marked as exploited.