VERT Threat Alert: September 2024 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s September 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1123 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2024-38217

Windows uses the Mark of the Web (MoTW) to identify files downloaded from the Internet. This is done by setting the NTFS Zone.Identifier alternate Data Stream (ADS). This mark is used to notify users via SmartScreen that they are about to run a potentially dangerous file. This publicly disclosed vulnerability allows malicious files to bypass SmartScreen. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38014

A vulnerability in the Windows Installer could allow an attacker to elevate privileges and gain SYSTEM level access. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38226

A vulnerability in Microsoft Publisher could allow attackers to bypass the Office macro policies that are used to block macros in untrusted or malicious files. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-43491

This is an interesting vulnerability that was discovered internally at Microsoft. An update released in March 2024 caused certain optional components on Windows 10 1507 to roll back to their RTM versions. The components affected includes:

• .NET Framework 4.6 Advanced Services \ ASP.NET 4.6
• Active Directory Lightweight Directory Services
• Administrative Tools
• Internet Explorer 11
• IIS\WWW Services
• LPD Print Service
• MSMQ Server Core
• MSMQ HTTP Support
• SMB 1.0/CIFS File Sharing Support
• Windows Fax and Scan
• Windows Media Player
• Work Folders Client
• XPS Viewer

It is important to note that KB5043936, the Servicing Stack Update, must be installed before KB5043083, the September Cumulative Update. Microsoft has reported this vulnerability as Exploitation Detected, however this is due to the optional component vulnerabilities that were rolled back to unpatched versions and not CVE-2024-43491.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted

Other Information

At the time of publication, there were no new advisories included with the September Security Guidance.