Four zero-days fixed for September Patch Tuesday

Deploying patches to correct four zero-days under active exploit should take top priority for Microsoft admins this month.

On September Patch Tuesday, Microsoft addressed 79 new CVEs with seven rated critical. Microsoft also released updates to eight older vulnerabilities. As usual, most fixes were for the Windows operating system. But organizations that rely on SQL Server or SharePoint should roll out fixes for those platforms in short order.

The first zero-day, CVE-2024-43491, is a Microsoft Windows Update remote-code execution vulnerability rated critical with a base CVSS rating of 9.8.

The bug affects systems that run Windows 10 version 1507 on security updates from March 2024 to August 2024 that have certain optional components enabled, such as the LPD Print Service, Internet Explorer 11 and Windows Media Player.

Microsoft released Windows 10 version 1507 in July 2015 and ended support in May 2017. But two specialized versions of that product -- Windows 10 LTSB 2015 and Windows 10 IoT LTSB 2015 Enterprise editions -- have support until October 2025 and received security updates on September Patch Tuesday.

Chris Goettl, vice president of security product management at Ivanti, told TechTarget Editorial that the footprint of affected systems is likely to be small due to the specific nature of those editions.

"I would expect most deployments are in environments with a Windows 10 system hooked up to a device that does not change very often," he said. "This would be used in the manufacturing space or areas where the device is hooked up to a major piece of infrastructure, such as an energy plant."

Microsoft reported that this Windows zero-day stems from a Servicing Stack issue that rolled back corrections for previously patched vulnerabilities. Microsoft said versions of Windows 10 released after November 2015 are not affected.

Admins will have to pay attention and install the September 2024 Servicing Stack Update KB5043936 and September 2024 Windows Security Update KB5043083 in that sequence to mitigate the vulnerability.

The second zero-day is a Microsoft Publisher security feature bypass vulnerability, CVE-2024-38226, rated important with a base CVSS rating of 7.3, affecting Microsoft Publisher 2016, Microsoft Office LTSC 2021 and Microsoft Office 2019.

After successfully exploiting this vulnerability, an attacker can get around Office macro policies that protect the system from untrusted or malicious files. The threat actor must get the user to open a specially crafted file to trigger the exploit.

The third zero-day is a Windows Mark of the Web (MOTW) security feature bypass vulnerability, CVE-2024-38217, rated important with a base CVSS rating of 5.4. It affects Windows desktop and server systems. This flaw was also publicly disclosed, and Microsoft reported that functional exploit code exists.

The exploit requires user interaction so the threat actor must convince the targeted individual to download and open the file. If successful, the attacker can evade MOTW protections in the Windows OS, including SmartScreen Application Reputation checks and Windows Attachment services security prompts.

The fourth zero-day is a Windows Installer elevation-of-privilege vulnerability, CVE-2024-38014, rated important with a base CVSS score of 7.8 that affects both Windows desktop and server systems. A successful exploit gives the attacker system privileges on the device.

This vulnerability only requires low privileges and does not need user interaction, which makes it ideal for a threat actor who combines several vulnerabilities to solidify their position in an organization's environment.

"Typically, this is used in an attack where you chain two or three vulnerabilities together. They get in by convincing the user to click on something they shouldn't. Then, they elevate their privileges and use remote-code execution or the Mark of the Web bypass to install something bad," Goettl said.