Microsoft Patch Tuesday: September 2024 Brings Fixes for 79 Vulnerabilities, Including Four Actively Exploited Zero-Days

Microsoft's September 2024 Patch Tuesday delivered a significant wave of security updates, addressing a whopping 79 vulnerabilities across various products and services. This month's patch cycle holds particular importance due to the inclusion of fixes for four actively exploited zero-day vulnerabilities, one of which was publicly disclosed.

Zero-Day Vulnerabilities: A Threat in Real-Time

The term "zero-day" signifies a security flaw that is publicly disclosed or actively exploited in the wild before a patch is released. This poses a significant risk to users as attackers can leverage these vulnerabilities before any defense measures are implemented.

The September 2024 Zero-Day Vulnerabilities:

1. CVE-2024-38014: Windows Installer Elevation of Privilege Vulnerability: This flaw allows attackers to gain SYSTEM privileges on Windows systems. While Microsoft hasn't shared details about how this vulnerability was exploited, its severity necessitates immediate patching.

2. CVE-2024-38217: Windows Mark of the Web Security Feature Bypass Vulnerability: Publicly disclosed last month by Joe Desimone of Elastic Security, this vulnerability has been exploited since 2018. The "LNK stomping" technique allows attackers to bypass security warnings and execute commands through specially crafted LNK files, potentially leading to significant security breaches.

3. CVE-2024-38226: Microsoft Publisher Security Feature Bypass Vulnerability: This vulnerability allows attackers to bypass security protections against embedded macros in downloaded documents. This means malicious actors can potentially deliver harmful payloads disguised within seemingly harmless documents.

4. CVE-2024-43491: Microsoft Windows Update Remote Code Execution Vulnerability: This issue stems from a servicing stack flaw that allows attackers to execute code remotely. Interestingly, this vulnerability specifically affects Windows 10 version 1507, which reached its end-of-life in 2017. However, it also impacts Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions, which are still supported. This vulnerability also caused a rollback of certain Optional Components in Windows 10 version 1507, reintroducing previously patched vulnerabilities.

Beyond Zero-Days: A Comprehensive Patch Landscape

The September 2024 Patch Tuesday goes beyond just zero-day fixes, offering a broad spectrum of security updates categorized by vulnerability type:

• Elevation of Privilege (30): These flaws allow attackers to gain higher privileges within a system, potentially leading to full system control.

• Security Feature Bypass (4): These vulnerabilities allow attackers to bypass security measures, enabling them to exploit other vulnerabilities.

• Remote Code Execution (23): This category includes vulnerabilities that allow attackers to execute malicious code on a target system, granting them control.

• Information Disclosure (11): These flaws expose sensitive information to attackers, potentially leading to data breaches or further exploits.

• Denial of Service (8): These vulnerabilities aim to disrupt service availability by overloading or crashing systems.

• Spoofing (3): These flaws allow attackers to impersonate legitimate users or entities, potentially tricking victims into sharing sensitive information.

The Importance of Patching: A Vital Security Measure

The September 2024 Patch Tuesday highlights the critical importance of staying up-to-date with security updates. Failing to patch systems promptly leaves them vulnerable to exploitation, making them prime targets for malicious actors.

Patching Tips and Best Practices:

• Install Updates Promptly: Apply security patches as soon as possible after their release.

• Implement Automated Patching: Set up automated patching mechanisms to ensure regular updates without manual intervention.

• Test Patches Before Deployment: Where possible, test updates in a controlled environment to minimize potential disruption.

• Keep a Record of Patching: Maintain a record of applied patches to facilitate troubleshooting and security audits.

• Stay Informed: Stay informed about new vulnerabilities and security advisories.

Beyond Microsoft: Updates From Other Vendors

Beyond Microsoft's Patch Tuesday, other software vendors have also released security updates in September 2024, addressing critical vulnerabilities across a range of products. These include:

• Apache: Addressing a critical OFBiz remote code execution vulnerability that bypassed previously fixed flaws.

• Cisco: Fixing multiple vulnerabilities, including a backdoor admin account in Smart Licensing Utility and a command injection vulnerability in ISE.

• Eucleak Attack: This attack method extracts ECDSA secret keys to clone YubiKey FIDO devices.

• Fortinet: Releasing security updates for flaws in Fortisandbox and FortiAnalyzer & FortiManager.

• Google: Backporting a fix for an actively exploited Pixel elevation of privileges flaw to other Android devices.

• Ivanti: Releasing security updates for a critical vTM auth bypass vulnerability with a public exploit.

• LiteSpeed Cache: This plugin for WordPress fixed an unauthenticated account takeover issue.

• SonicWall: Addressing a previously fixed access control flaw that is now exploited in ransomware attacks.

• Veeam: Fixing a critical RCE vulnerability in Backup & Replication software.

• Zyxel: Issuing a warning about a critical OS command injection flaw in its routers.

The Comprehensive List of September 2024 Patch Tuesday Updates:

The following table provides a complete list of vulnerabilities addressed in the September 2024 Patch Tuesday updates. To access a full description of each vulnerability and the affected systems, you can consult the Microsoft Security Update Guide.

Tag	CVE ID	CVE Title	Severity
Azure CycleCloud	CVE-2024-43469	Azure CycleCloud Remote Code Execution Vulnerability	Important
Azure Network Watcher	CVE-2024-38188	Azure Network Watcher VM Agent Elevation of Privilege Vulnerability	Important
Azure Network Watcher	CVE-2024-43470	Azure Network Watcher VM Agent Elevation of Privilege Vulnerability	Important
Azure Stack	CVE-2024-38216	Azure Stack Hub Elevation of Privilege Vulnerability	Critical
Azure Stack	CVE-2024-38220	Azure Stack Hub Elevation of Privilege Vulnerability	Critical
Azure Web Apps	CVE-2024-38194	Azure Web Apps Elevation of Privilege Vulnerability	Critical
Dynamics Business Central	CVE-2024-38225	Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability	Important
Microsoft AutoUpdate (MAU)	CVE-2024-43492	Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability	Important
Microsoft Dynamics 365 (on-premises)	CVE-2024-43476	Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability	Important
Microsoft Graphics Component	CVE-2024-38247	Windows Graphics Component Elevation of Privilege Vulnerability	Important
Microsoft Graphics Component	CVE-2024-38250	Windows Graphics Component Elevation of Privilege Vulnerability	Important
Microsoft Graphics Component	CVE-2024-38249	Windows Graphics Component Elevation of Privilege Vulnerability	Important
Microsoft Management Console	CVE-2024-38259	Microsoft Management Console Remote Code Execution Vulnerability	Important
Microsoft Office Excel	CVE-2024-43465	Microsoft Excel Elevation of Privilege Vulnerability	Important
Microsoft Office Publisher	CVE-2024-38226	Microsoft Publisher Security Feature Bypass Vulnerability	Important
Microsoft Office SharePoint	CVE-2024-38227	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important
Microsoft Office SharePoint	CVE-2024-43464	Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical
Microsoft Office SharePoint	CVE-2024-38018	Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical
Microsoft Office SharePoint	CVE-2024-38228	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important
Microsoft Office SharePoint	CVE-2024-43466	Microsoft SharePoint Server Denial of Service Vulnerability	Important
Microsoft Office Visio	CVE-2024-43463	Microsoft Office Visio Remote Code Execution Vulnerability	Important
Microsoft Outlook for iOS	CVE-2024-43482	Microsoft Outlook for iOS Information Disclosure Vulnerability	Important
Microsoft Streaming Service	CVE-2024-38245	Kernel Streaming Service Driver Elevation of Privilege Vulnerability	Important
Microsoft Streaming Service	CVE-2024-38241	Kernel Streaming Service Driver Elevation of Privilege Vulnerability	Important
Microsoft Streaming Service	CVE-2024-38242	Kernel Streaming Service Driver Elevation of Privilege Vulnerability	Important
Microsoft Streaming Service	CVE-2024-38244	Kernel Streaming Service Driver Elevation of Privilege Vulnerability	Important
Microsoft Streaming Service	CVE-2024-38243	Kernel Streaming Service Driver Elevation of Privilege Vulnerability	Important
Microsoft Streaming Service	CVE-2024-38237	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability	Important
Microsoft Streaming Service	CVE-2024-38238	Kernel Streaming Service Driver Elevation of Privilege Vulnerability	Important
Power Automate	CVE-2024-43479	Microsoft Power Automate Desktop Remote Code Execution Vulnerability	Important
Role: Windows Hyper-V	CVE-2024-38235	Windows Hyper-V Denial of Service Vulnerability	Important
SQL Server	CVE-2024-37338	Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important
SQL Server	CVE-2024-37980	Microsoft SQL Server Elevation of Privilege Vulnerability	Important
SQL Server	CVE-2024-26191	Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important
SQL Server	CVE-2024-37339	Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important
SQL Server	CVE-2024-37337	Microsoft SQL Server Native Scoring Information Disclosure Vulnerability	Important
SQL Server	CVE-2024-26186	Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important
SQL Server	CVE-2024-37342	Microsoft SQL Server Native Scoring Information Disclosure Vulnerability	Important
SQL Server	CVE-2024-43474	Microsoft SQL Server Information Disclosure Vulnerability	Important
SQL Server	CVE-2024-37335	Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important
SQL Server	CVE-2024-37966	Microsoft SQL Server Native Scoring Information Disclosure Vulnerability	Important
SQL Server	CVE-2024-37340	Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important
SQL Server	CVE-2024-37965	Microsoft SQL Server Elevation of Privilege Vulnerability	Important
SQL Server	CVE-2024-37341	Microsoft SQL Server Elevation of Privilege Vulnerability	Important
Windows Admin Center	CVE-2024-43475	Microsoft Windows Admin Center Information Disclosure Vulnerability	Important
Windows AllJoyn API	CVE-2024-38257	Microsoft AllJoyn API Information Disclosure Vulnerability	Important
Windows Authentication Methods	CVE-2024-38254	Windows Authentication Information Disclosure Vulnerability	Important
Windows DHCP Server	CVE-2024-38236	DHCP Server Service Denial of Service Vulnerability	Important
Windows Installer	CVE-2024-38014	Windows Installer Elevation of Privilege Vulnerability	Important
Windows Kerberos	CVE-2024-38239	Windows Kerberos Elevation of Privilege Vulnerability	Important
Windows Kernel-Mode Drivers	CVE-2024-38256	Windows Kernel-Mode Driver Information Disclosure Vulnerability	Important
Windows Libarchive	CVE-2024-43495	Windows libarchive Remote Code Execution Vulnerability	Important
Windows Mark of the Web (MOTW)	CVE-2024-38217	Windows Mark of the Web Security Feature Bypass Vulnerability	Important
Windows Mark of the Web (MOTW)	CVE-2024-43487	Windows Mark of the Web Security Feature Bypass Vulnerability	Moderate
Windows MSHTML Platform	CVE-2024-43461	Windows MSHTML Platform Spoofing Vulnerability	Important
Windows Network Address Translation (NAT)	CVE-2024-38119	Windows Network Address Translation (NAT) Remote Code Execution Vulnerability	Critical
Windows Network Virtualization	CVE-2024-38232	Windows Networking Denial of Service Vulnerability	Important
Windows Network Virtualization	CVE-2024-38233	Windows Networking Denial of Service Vulnerability	Important
Windows Network Virtualization	CVE-2024-38234	Windows Networking Denial of Service Vulnerability	Important
Windows Network Virtualization	CVE-2024-43458	Windows Networking Information Disclosure Vulnerability	Important
Windows PowerShell	CVE-2024-38046	PowerShell Elevation of Privilege Vulnerability	Important
Windows Remote Access Connection Manager	CVE-2024-38240	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Important
Windows Remote Desktop Licensing Service	CVE-2024-38231	Windows Remote Desktop Licensing Service Denial of Service Vulnerability	Important
Windows Remote Desktop Licensing Service	CVE-2024-38258	Windows Remote Desktop Licensing Service Information Disclosure Vulnerability	Important
Windows Remote Desktop Licensing Service	CVE-2024-43467	Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability	Important
Windows Remote Desktop Licensing Service	CVE-2024-43454	Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability	Important
Windows Remote Desktop Licensing Service	CVE-2024-38263	Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability	Important
Windows Remote Desktop Licensing Service	CVE-2024-38260	Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability	Important
Windows Remote Desktop Licensing Service	CVE-2024-43455	Windows Remote Desktop Licensing Service Spoofing Vulnerability	Important
Windows Security Zone Mapping	CVE-2024-30073	Windows Security Zone Mapping Security Feature Bypass Vulnerability	Important
Windows Setup and Deployment	CVE-2024-43457	Windows Setup and Deployment Elevation of Privilege Vulnerability	Important
Windows Standards-Based Storage Management Service	CVE-2024-38230	Windows Standards-Based Storage Management Service Denial of Service Vulnerability	Important
Windows Storage	CVE-2024-38248	Windows Storage Elevation of Privilege Vulnerability	Important
Windows TCP/IP	CVE-2024-21416	Windows TCP/IP Remote Code Execution Vulnerability	Important
Windows TCP/IP	CVE-2024-38045	Windows TCP/IP Remote Code Execution Vulnerability	Important
Windows Update	CVE-2024-43491	Microsoft Windows Update Remote Code Execution Vulnerability	Critical
Windows Win32K - GRFX	CVE-2024-38246	Win32k Elevation of Privilege Vulnerability	Important
Windows Win32K - ICOMP	CVE-2024-38252	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important
Windows Win32K - ICOMP	CVE-2024-38253	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important

Staying Safe in a Cyber-Threat Landscape

The constant emergence of vulnerabilities underscores the ever-evolving nature of cybersecurity. Staying informed about new threats, prioritizing patching, and implementing robust security practices are crucial to safeguarding systems and data. By staying proactive, users can significantly reduce their risk and maintain a secure digital environment.