Microsoft Discloses 4 Zero-Days in September Update

Attackers are already actively exploiting four of the 79 vulnerabilities for which Microsoft issued a patch this week as part of its monthly security update.

Two of the zero-day bugs give attackers a way to bypass critical security protections in Windows and therefore should be at the top of any organization's priority list for remediation.

One of the remaining zero-days is an elevation of privilege flaw that enables access to system-level privileges; the other is a bug that rolled back, or reintroduced, vulnerabilities in certain versions of Windows 10 for which Microsoft had previously issued patches.

In total, Microsoft's September update contained seven critical remote code execution (RCE) and elevation of privilege vulnerabilities. The company assessed 19 of the CVEs in its latest updates as vulnerabilities that attackers are more likely to exploit because they enable remote code execution, involve attacks that are low in complexity, require no user interaction, and exist in widely deployed products, as well as other factors.

Security Bypass Zero-Days

One of the security bypass vulnerabilities, tracked as CVE-2024-38226, affects Microsoft Publisher. It allows an attacker with authenticated access to a system to bypass Microsoft Office macros for blocking untrusted and malicious files. "An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer," Microsoft said. The company gave the vulnerability a moderate CVSS severity score of 6.8 of 10, presumably because an attacker would need to convince a user to open a malicious file in order for any exploit to work.

The other security bypass zero-day bug in Microsoft's September update is CVE-2024-38217, in the Windows Mark of the Web (MoTW) feature that is designed to protect users against potentially harmful files and content downloaded from the Web. The vulnerability allows an attacker to sneak malicious files past MoTW defenses and cause what Microsoft described as "limited loss" of integrity and availability of application reputation checks and other security features. Microsoft assigned CVE-2024-38217 a severity rating of 5 because to exploit it an attacker would need to convince potential victims to visit an attacker-controlled site and then download a malicious file from there.

"Exploitation of both CVE-2024-38226 and CVE-2024-38217 can lead to the bypass of important security features that block Microsoft Office macros from running," Satnam Narang, senior staff research engineer at Tenable, said in a statement. "In both cases, the target needs to be convinced to open a specially crafted file from an attacker-controlled server. Where they differ is that an attacker would need to be authenticated to the system and have local access to it to exploit CVE-2024-38226," he said.

RCE and Privilege Escalation Zero-Days

The two other bugs in Microsoft's latest update that attackers are already actively exploiting are CVE-2024-38014 and CVE-2024-43491. CVE-2024-38014 is an elevation of privilege vulnerability in Windows Installer that attackers can use to gain system-level privileges. As with the other zero-days, Microsoft's advisory offered no details on the exploit activity targeting the bug or when it might have started. Despite the ongoing attacks targeting CVE-2024-38014, Microsoft assessed the flaw as only moderately severe (7.8 on 10 on the CVSS scale) because an attacker would already need to have compromised an affected system to exploit the vulnerability.

CVE-2024-43491, meanwhile, is a high-severity (CVSS score 8.5) RCE in Microsoft Windows Update. The vulnerability rolls back fixes that Microsoft issued in March for certain versions of Windows 10. According to Microsoft, the vulnerability gives attackers a way to exploit vulnerabilities that Microsoft previously mitigated in Windows 10, version 1507, between March and August. "Customers need to install both the servicing stack update (KB5043936) AND security update (KB5043083), released on September 10, 2024, to be fully protected from the vulnerabilities that this CVE rolled back," Microsoft said.

Kev Breen, senior director of threat research at Immersive Lab, advocated that administrators pay close attention to Microsoft's Official Notes for CVE-2024-43491. "There are a lot of caveats to this one," Breen said in emailed comments. "The short version is that some versions of Windows 10 with optional components enabled was left in a vulnerable state," since March.

This is the second month in a row where Microsoft has given administrators multiple zero-days to contend with. In August, the company disclosed six of them — equal to the total for the entire year up to that point.

Other High-Priority Bugs

Other bugs of note in the latest update according to security researchers include CVE-2024-43461, a Windows spoofing vulnerability; CVE-2024-38018, a Microsoft SharePoint Server RCE; and CVE-2024-38241 and CVE-2024-38242, two elevation-of-privilege vulnerabilities in Kernel Streaming Service Driver.

CVE-2024-43461 affects all supported versions of Microsoft Windows. It is similar to CVE-2024-38112, a zero-day bug that Microsoft patched in July after at least two threat groups had been exploiting it for 18 months. Attackers could leverage the exploits for CVE-2024-38112 in attacks against the new CVE-2024-43416, according to Saeed Abbasi, manager of vulnerability research at Qualys. "There exists a high likelihood of exploitation, as this vulnerability enables attackers to spoof legitimate web content, leading to unauthorized actions such as phishing and data theft," Abbasi said in emailed comments.

Organizations need to prioritize patching the Microsoft SharePoint Server RCE vulnerability (CVE-2024-38018) because no mitigations or workarounds are available for it, said Tom Bowyer, director IT security of Automox, in emailed comments. "The potential impact of this CVE is significant, especially given the business-critical nature SharePoint servers play in organizations that utilize them," and the ease of exploitation.

Ben McCarthy, lead cybersecurity engineer at Immersive Labs, identified the Kernel Streaming Service Driver flaws (CVE-2024-38241 and CE-2024-38242) as important to address because they are present at the kernel level and give attackers a way to bypass security controls, escalate privileges, execute arbitrary code, and take over the whole system.

So far this year, Microsoft has disclosed a total of 745 vulnerabilities across its products, according to numbers maintained by Automox. Microsoft has identified just 33 of them as critical.

Don't miss the latest Dark Reading Confidential podcast, where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa and forced to spend the night in jail -- just for doing their pen-testing jobs. Listen now!