What’s New Wednesday: A Summary of September 2024’s Patch Tuesday September 11, 2024 – Posted in: Cyber Security, IT Support, News, What's New Wednesdays – Tags: cybersecurity, Microsoft, Patch Tuesday, patching, WhatsNewWednesday

The Microsoft monthly security update release is published on the second Tuesday of each month. It’s a good idea to restart your PC on the following Wednesday – today. We may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

This month’s Patch Tuesday included security updates for 79 flaws and 4 actively exploited zero-day vulnerabilities patched. Overall Microsoft patched:

• 30 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 23 Remote Code Execution Vulnerabilities
• 11 Information Disclosure Vulnerabilities
• 8 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

There were 4 actively exploited zero-day vulnerabilities patched, one of which is publicly disclosed:

CVE-2024-43491 – Microsoft Windows Update Remote Code Execution Vulnerability
a servicing stack flaw that allows remote code execution and rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 allowing an attacker to exploit these previously mitigated vulnerabilities.
CVE-2024-38226 – Microsoft Publisher Security Feature Bypass Vulnerability
bypasses the security protections against embedded macros used to block untrusted or malicious files in downloaded documents.
CVE-2024-38217 – Windows Mark of the Web Security Feature Bypass Vulnerability
publicly disclosed last month and believed to have been actively exploited since 2018. Allows specially crafted files to cause the file to be opened while bypassing Smart App Control and the Mark of the Web security warnings, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt.
CVE-2024-38014 – Windows Installer Elevation of Privilege Vulnerability
allows attacks to gain SYSTEM privileges on Windows systems.

Releases from other software providers include:

• Apache – fixed a critical OFBiz remote code execution vulnerability that was a bypass for previously fixed flaws.
• Cisco – fixed multiple vulnerabilities this month, including a backdo
• Eucleak – attack extracts ECDSA secret keys to clone YubiKey FIDO devices.
• Fortinet – updates for flaws in Fortisandbox and FortiAnalyzer & FortiManager.
• Google – fixed an actively exploited Pixel elevation of privileges flaw to other Android devices.
• Ivanti – updates for critical vTM auth bypass with public exploit.
• LiteSpeed Cache plugin for WordPress – fixes an unauthenticated account takeover issue.
• SonicWall – an access control flaw fixed last month is now exploited in ransomware attacks.
• Veeam – fixed a critical RCE vulnerability in Backup & Replication software.
• Zyxel – warned of a critical OS command injection flaw in its routers.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.