Microsoft’s September 2024 Patch Tuesday has addressed a significant number of security vulnerabilities, including four zero-day exploits and a total of 79 vulnerabilities across various products.

This monthly update is crucial for maintaining the security and integrity of systems running Microsoft software, especially given the critical nature of some of the vulnerabilities addressed.

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

Key Zero-Day Vulnerabilities

CVE-2024-43491: Microsoft Windows Update RCE

This vulnerability affects the servicing stack of Windows 10 version 1507, allowing remote code execution due to a rollback of previous security fixes. It can be exploited over a network without user interaction, making it highly dangerous. Although Microsoft has not detected active exploitation of this specific vulnerability, it poses a significant threat due to its potential to undo past patches.

“Windows 10, version 1507 reached the end of support (EOS) on May 9, 2017 for devices running the Pro, Home, Enterprise, Education, and Enterprise IoT editions. Only Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions are still under support,” Microsoft added.

CVE-2024-38014: Windows Installer Elevation of Privilege Vulnerability

This zero-day vulnerability allows attackers to gain SYSTEM-level privileges by exploiting improper privilege management within the Windows Installer. It has been actively exploited in the wild, making it a priority for immediate patching.

CVE-2024-38226: Microsoft Publisher Security Feature Bypass Vulnerability

This vulnerability allows attackers to bypass macro policies in Microsoft Publisher, potentially leading to the execution of untrusted files. Successful exploitation requires user interaction but has been actively exploited, highlighting its risk.

“The attack itself is carried out locally by a user with authentication to the targeted system. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer,” Microsoft added.

CVE-2024-38217: Windows Mark of the Web Security Feature Bypass Vulnerability

This flaw allows attackers to bypass security warnings for files downloaded from the internet, which could lead to the execution of malicious files. It has been publicly disclosed and exploited in the wild, often associated with ransomware attacks.

“To exploit this vulnerability, an attacker could host a file on an attacker-controlled server, then convince a targeted user to download and open the file. This could allow the attacker to interfere with the Mark of the Web functionality.”

Overall Vulnerability Breakdown

Total Vulnerabilities Fixed: 79
Critical Vulnerabilities: 7
Categories:
Elevation of Privilege: 30
Remote Code Execution: 23
Security Feature Bypass: 4
Information Disclosure: 11
Denial of Service: 8
Spoofing: 3

The vulnerabilities addressed in this Patch Tuesday update highlight the importance of timely patch management. Organizations and individual users are urged to apply these updates immediately to mitigate potential risks. The critical vulnerabilities, particularly those allowing remote code execution and privilege escalation, pose significant threats to system security and data integrity.

Security experts emphasize the importance of not only applying patches but also educating users about the risks of downloading and executing files from untrusted sources. This is particularly relevant for vulnerabilities like CVE-2024-38217, which rely on user interaction to be exploited.

Microsoft’s September 2024 Patch Tuesday is a critical update that addresses several high-risk vulnerabilities. Users and administrators should prioritize these updates to protect their systems from potential exploitation.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

The post Microsoft Security Update, 4 Zero-days & 79 Vulnerabilities Fixed appeared first on Cyber Security News.