Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

Microsoft’s September 2024 Patch Tuesday, which includes security updates for 79 flaws, including three actively exploited and one publicly disclosed zero-days.

This Patch Tuesday fixed seven critical vulnerabilities, which were either remote code execution or elevation of privileges flaws.

The number of bugs in each vulnerability category is listed below:

• 30 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 23 Remote Code Execution Vulnerabilities
• 11 Information Disclosure Vulnerabilities
• 8 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

Four zero-days disclosed

This month’s Patch Tuesday fixes three actively exploited, one of which was publicly disclosed, and another that reintroduces old CVEs so is marked as exploited.

Microsoft classifies a zero-day flaw as one that is publicly disclosed or actively exploited while no official fix is available.

The three actively exploited zero-day vulnerabilities in today’s updates are:

CVE-2024-38014 – Windows Installer Elevation of Privilege Vulnerability

This vulnerability allows attacks to gain SYSTEM privileges on Windows systems.

Microsoft has not shared any details on how it was exploited in attacks.

The flaw was discovered by Michael Baer with SEC Consult Vulnerability Lab. 

CVE-2024-38217 – Windows Mark of the Web Security Feature Bypass Vulnerability

This flaw was publicly disclosed last month by Joe Desimone of Elastic Security and is believed to have been actively exploited since 2018.

In the report, Desimone outlined a technique called LNK stomping that allows specially crafted LNK files with non-standard target paths or internal structures to cause the file to be opened while bypassing Smart App Control and the Mark of the Web security warnings.

“An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt,” explains Microsoft’s advisory.

CVE-2024-38226 – Microsoft Publisher Security Feature Bypass Vulnerability

Microsoft fixed a Microsoft Publisher flaw that bypasses the security protections against embedded macros in downloaded documents.

“An attacker who successfully exploited this vulnerability could bypass Office macro policies used to block untrusted or malicious files,” explains Microsoft’s advisory.

Microsoft has not shared who disclosed the flaw and how it was exploited.

Microsoft also fixed a zero-day that is marked as exploited, but was done so as it can reintroduce older exploited flaws, as explained below.

CVE-2024-43491 – Microsoft Windows Update Remote Code Execution Vulnerability

Microsoft fixed a servicing stack flaw that is marked as remote code execution, but actually reintroduces a variety of vulnerabilities to previously patched programs.

“Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015),” explains Microsoft’s advisory.

The September 2024 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the September 2024 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.

Update 9/11/24: Updated to explain that only three flaws were actively exploited and why CVE-2024-43491 was marked as exploited.