Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

At this time is Microsoft’s September 2024 Patch Tuesday, which incorporates security updates for 79 flaws, together with 4 actively exploited and one publicly disclosed zero-days.

This Patch Tuesday mounted seven important vulnerabilities, which have been both distant code execution or elevation of privileges flaws.

The variety of bugs in every vulnerability class is listed beneath:

• 30 Elevation of Privilege Vulnerabilities
• 4 Safety Characteristic Bypass Vulnerabilities
• 23 Distant Code Execution Vulnerabilities
• 11 Info Disclosure Vulnerabilities
• 8 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

To study extra concerning the non-security updates launched at present, you possibly can assessment our devoted articles on the brand new Home windows 11 KB5043076 cumulative replace and Home windows 10 KB5043064 replace.

4 zero-days disclosed

This month’s Patch Tuesday fixes 4 actively exploited, one in every of which was publicly disclosed. 

Microsoft classifies a zero-day flaw as one that’s publicly disclosed or actively exploited whereas no official repair is on the market.

The 4 actively exploited zero-day vulnerabilities in at present’s updates are:

CVE-2024-38014 – Home windows Installer Elevation of Privilege Vulnerability

This vulnerability permits assaults to achieve SYSTEM privileges on Home windows programs.

Microsoft has not shared any particulars on the way it was exploited in assaults.

The flaw was found by Michael Baer with SEC Seek the advice of Vulnerability Lab. 

CVE-2024-38217 – Home windows Mark of the Internet Safety Characteristic Bypass Vulnerability

This flaw was publicly disclosed final month by Joe Desimone of Elastic Safety and is believed to have been actively exploited since 2018.

Within the report, Desimone outlined a way known as LNK stomping that permits specifically crafted LNK recordsdata with non-standard goal paths or inner constructions to trigger the file to be opened whereas bypassing Good App Management and the Mark of the Internet security warnings.

“An attacker can craft a malicious file that will evade Mark of the Internet (MOTW) defenses, leading to a restricted lack of integrity and availability of security options resembling SmartScreen Utility Repute security verify and/or the legacy Home windows Attachment Companies security immediate,” explains Microsoft’s advisory.

When exploited, it causes the command within the LNK file to be executed with no warning, as demonstrated on this video.

CVE-2024-38226 – Microsoft Writer Safety Characteristic Bypass Vulnerability

Microsoft mounted a Microsoft Writer flaw that bypasses the security protections towards embedded macros in downloaded paperwork.

“An attacker who efficiently exploited this vulnerability may bypass Workplace macro insurance policies used to dam untrusted or malicious recordsdata,” explains Microsoft’s advisory.

Microsoft has not shared who disclosed the flaw and the way it was exploited.

CVE-2024-43491 – Microsoft Home windows Replace Distant Code Execution Vulnerability

Microsoft mounted a servicing stack flaw that permits distant code execution.

“Microsoft is conscious of a vulnerability in Servicing Stack that has rolled again the fixes for some vulnerabilities affecting Elective Parts on Home windows 10, model 1507 (preliminary model launched July 2015),” explains Microsoft’s advisory.

“Which means that an attacker may exploit these beforehand mitigated vulnerabilities on Home windows 10, model 1507 (Home windows 10 Enterprise 2015 LTSB and Home windows 10 IoT Enterprise 2015 LTSB) programs which have put in the Home windows security replace launched on March 12, 2024—KB5035858 (OS Construct 10240.20526) or different updates launched till August 2024. All later variations of Home windows 10 are usually not impacted by this vulnerability.”

“This servicing stack vulnerability is addressed by putting in the September 2024 Servicing stack replace (SSU KB5043936) AND the September 2024 Home windows security replace (KB5043083), in that order.”

This flaw solely impacts Home windows 10, model 1507, which reached the tip of life in 2017. Nevertheless, it additionally impacts Home windows 10 Enterprise 2015 LTSB and Home windows 10 IoT Enterprise 2015 LTSB editions, that are nonetheless below assist.

This flaw is attention-grabbing as a result of it prompted Elective Parts, resembling Energetic Listing Light-weight Listing Companies, XPS Viewer, Web Explorer 11, LPD Print Service, IIS, and Home windows Media Participant to roll again to their authentic RTM variations.

This prompted any earlier CVE to be reintroduced into this system, which may then be exploited.

Extra particulars concerning the flaw and the entire record of affected elements can present in Microsoft’s advisory.

Microsoft has not shared who disclosed the flaw and the way it was exploited.

Latest updates from different corporations

Different distributors who launched updates or advisories in September 2024 embrace:

The September 2024 Patch Tuesday Safety Updates

Under is the entire record of resolved vulnerabilities within the September 2024 Patch Tuesday updates.

To entry the total description of every vulnerability and the programs it impacts, you possibly can view the full report right here.