VULNERA Pulse

Microsoft — Windows

CVE-2024-43491 / Added: Sept. 10, 2024

CRITICAL CVSS 9.80 EPSS Score 2.32 EPSS Percentile 89.97

Microsoft Windows Update contains a use-after-free vulnerability that allows for remote code execution.

Headlines

• Sept. 12, 2024 - September Patch Tuesday addresses 79 CVEs
• Sept. 11, 2024 - CVE-2024-43491 (CVSS 9.8): Critical Windows 0-Day Flaw Uncovered, Urgent Patching Required
• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 11, 2024 - Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
• Sept. 11, 2024 - Microsoft broke Windows 10 patching, fixes exploited bugs
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

Back to top ↑

Microsoft — Windows

CVE-2024-38014 / Added: Sept. 10, 2024

HIGH CVSS 7.80 EPSS Score 0.06 EPSS Percentile 23.61

Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.

Headlines

• Sept. 12, 2024 - More details on that Windows Installer 'make me admin' hole
• Sept. 12, 2024 - September Patch Tuesday addresses 79 CVEs
• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

Back to top ↑

Microsoft — Publisher

CVE-2024-38226 / Added: Sept. 10, 2024

HIGH CVSS 7.30 EPSS Score 0.05 EPSS Percentile 20.77

Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.

Headlines

• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 11, 2024 - Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

Back to top ↑

Microsoft — Windows

CVE-2024-38217 / Added: Sept. 10, 2024

MEDIUM CVSS 5.40 EPSS Score 0.27 EPSS Percentile 68.27

Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.

Headlines

• Sept. 12, 2024 - September Patch Tuesday addresses 79 CVEs
• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - LNK Stomping (CVE-2024-38217): Microsoft Patches Years-Old Zero-Day Flaw
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 11, 2024 - Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft fixes Windows Smart App Control zero-day exploited since 2018
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

Back to top ↑

SonicWall — SonicOS

CVE-2024-40766 / Added: Sept. 9, 2024

CRITICAL CVSS 9.80 EPSS Score 1.02 EPSS Percentile 84.13

SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.

Headlines

• Sept. 10, 2024 - CISA confirms that SonicWall vulnerability is getting exploited (CVE-2024-40766)
• Sept. 10, 2024 - Critical SonicWall SSLVPN Bug Exploited By Ransomware Actors
• Sept. 10, 2024 - U.S. CISA adds SonicWall SonicOS, ImageMagick and Linux Kernel bugs to its Known Exploited Vulnerabilities catalog
• Sept. 10, 2024 - CISA Alerts on Active Exploitation of Flaws in ImageMagick, Linux Kernel, and SonicWall
• Sept. 9, 2024 - Critical SonicWall SSLVPN bug exploited in ransomware attacks
• Sept. 9, 2024 - Akira Ransomware Actors Exploit SonicWall Bug for RCE
• Sept. 9, 2024 - Akira Ransomware Exploits SonicWall SSLVPN Flaw (CVE-2024-40766)
• Sept. 6, 2024 - A Vulnerability in SonicWall SonicOS Management Access and SSLVPN Could Allow for Unauthorized Resource Access
• Sept. 6, 2024 - SonicWall warns that SonicOS bug exploited in attacks
• Sept. 6, 2024 - SonicWall Urges Users to Patch Critical Firewall Flaw Amid Possible Exploitation
• Sept. 6, 2024 - SonicWall SSLVPN access control flaw is now exploited in attacks
• Sept. 6, 2024 - SonicWall Confirms Critical CVE-2024-40766 Vulnerability Actively Exploited in the Wild
• Sept. 1, 2024 - Week in review: SonicWall critical firewalls flaw fixed, APT exploits WPS Office for Windows RCE
• Aug. 26, 2024 - SonicWall patches critical flaw affecting its firewalls (CVE-2024-40766)
• Aug. 26, 2024 - SonicWall addressed improper access control issue in its firewalls
• Aug. 26, 2024 - SonicWall warns of critical access control flaw in SonicOS
• Aug. 26, 2024 - SonicWall Issues Critical Patch for Firewall Vulnerability Allowing Unauthorized Access
• Aug. 23, 2024 - SonicWall Issues Urgent Patch for Critical Firewall Vulnerability (CVE-2024-40766)

Back to top ↑

ImageMagick — ImageMagick

CVE-2016-3714 / Added: Sept. 9, 2024

HIGH CVSS 8.40 EPSS Score 97.36 EPSS Percentile 99.92

ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.

Headlines

• Sept. 10, 2024 - U.S. CISA adds SonicWall SonicOS, ImageMagick and Linux Kernel bugs to its Known Exploited Vulnerabilities catalog
• Sept. 10, 2024 - CISA Alerts on Active Exploitation of Flaws in ImageMagick, Linux Kernel, and SonicWall

Back to top ↑

Linux — Kernel

CVE-2017-1000253 / Added: Sept. 9, 2024

HIGH CVSS 7.80 EPSS Score 6.30 EPSS Percentile 93.78

Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.

Back to top ↑

CVE-2024-7591

CRITICAL CVSS 10.00 EPSS Score 0.04 EPSS Percentile 9.58

Actively Exploited Remote Code Execution

Published: Sept. 5, 2024

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above

Quotes

• It is possible for unauthenticated, remote attackers who have access to the management interface of LoadMaster to issue a carefully crafted HTTP request that will allow arbitrary system commands to be executed
• The CVE-2024-7591 vulnerability in Progress Software’s LoadMaster products is highly critical due to its 10/10 CVSS score, enabling unauthenticated remote attackers to execute arbitrary commands. Given Progress Software’s recent issues after the MOVEit breach, this vulnerability potentially exposes the brand to security concerns. LoadMaster is widely used for load balancing in enterprises, making this flaw a high-priority risk. Security teams should immediately apply the emergency fix, isolate vulnerable systems from untrusted networks, and restrict access to the management interface to trusted IPs only. The recommendation is that swift action is essential to avoid exploitation

Headlines

• Sept. 11, 2024 - Progress Software issues fix for maximum severity vulnerability
• Sept. 9, 2024 - Progress Software Issues Patch for Vulnerability in LoadMaster and MT Hypervisor
• Sept. 9, 2024 - Progress Software fixed a maximum severity flaw in LoadMaster
• Sept. 8, 2024 - Progress LoadMaster vulnerable to 10/10 severity RCE flaw

CVE-2024-43491

CRITICAL CVSS 9.80 EPSS Score 2.32 EPSS Percentile 89.97

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Sept. 10, 2024

Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker could exploit these previously mitigated vulnerabilities on Windows 10, version 1507 (Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB) systems that have installed the Windows security update released on March 12, 2024—KB5035858 (OS Build 10240.20526) or other updates released until August 2024. All later versions of Windows 10 are not impacted by this vulnerability. This servicing stack vulnerability is addressed by installing the September 2024 Servicing stack update (SSU KB5043936) AND the September 2024 Windows security update (KB5043083), in that order. Note: Windows 10, version 1507 reached the end of support (EOS) on May 9, 2017 for devices running the Pro, Home, Enterprise, Education, and Enterprise IoT editions. Only Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions are still under support.

Vendor Impacted: Microsoft

Products Impacted: Windows, Windows 10 1507

Quotes

• To correct this issue, users need to apply both the September 2024 Servicing Stack Update and the September 2024 Windows Security Updates
• The size of this release tracks with the volume we saw from Redmond last month, but again, it’s unusual to see such a high number of bugs under active attack
• This vulnerability emerged due to a rollback of fixes for certain previously mitigated vulnerabilities following the installation of security updates from March to August 2024
• An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer
• Crossed into a range that triggered a code defect in the Windows 10 (version 1507) servicing stack that handles the applicability of Optional Components. As a result, any Optional Component that was serviced with updates released since March 12, 2024 (KB5035858) was detected as
• Starting with the Windows security update released March 12, 2024 - KB5035858 (OS Build 10240.20526), the build version numbers crossed into a range that triggered a code defect in the Windows 10 (version 1507) servicing stack that handles the applicability of optional components
• An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt

Headlines

• Sept. 12, 2024 - September Patch Tuesday addresses 79 CVEs
• Sept. 11, 2024 - CVE-2024-43491 (CVSS 9.8): Critical Windows 0-Day Flaw Uncovered, Urgent Patching Required
• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 11, 2024 - Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
• Sept. 11, 2024 - Microsoft broke Windows 10 patching, fixes exploited bugs
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

CVE-2024-40766

CRITICAL CVSS 9.80 EPSS Score 1.02 EPSS Percentile 84.13

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware

Published: Aug. 23, 2024

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Vendor Impacted: Sonicwall

Products Impacted: Nssp 13700, Soho 250, Nsa 6700, Tz 300p, Tz670, Sm 9400, Tz 600, Tz 500, Nsa 4600, Tz 400, Nssp 12800, Sohow, Nsa 2650, Sonicos, Nssp 12400, Soho 250w, Tz 600p, Nsa 4700, Soho, Nsa 3700, Sm9800, Tz 400w, Tz270, Tz470, Nsa 5600, Tz 350w, Sm 9450, Tz270w, Nsa 3650, Sm 9250, Nsa 3600, Tz370w, Tz570p, Nsa 4650, Tz 500w, Sm 9650, Tz 350, Tz470w, Nssp 10700, Sm 9600, Tz 300w, Nsa 2700, Tz370, Tz 300, Nsa 5650, Tz570w, Tz570, Nssp 11700, Sm 9200, Nsa 5700, Nsa 6650, Nsa 6600

Quotes

• Potentially being exploited in the wild
• Apply the patch as soon as possible for affected products
• In each instance, the compromised accounts were local to the devices themselves rather than being integrated with a centralized authentication solution such as Microsoft Active Directory
• An improper access control vulnerability has been identified in the SonicWall SonicOS management access and SSLVPN, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash
• A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application’s data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption

Headlines

• Sept. 10, 2024 - CISA confirms that SonicWall vulnerability is getting exploited (CVE-2024-40766)
• Sept. 10, 2024 - Critical SonicWall SSLVPN Bug Exploited By Ransomware Actors
• Sept. 10, 2024 - U.S. CISA adds SonicWall SonicOS, ImageMagick and Linux Kernel bugs to its Known Exploited Vulnerabilities catalog
• Sept. 10, 2024 - CISA Alerts on Active Exploitation of Flaws in ImageMagick, Linux Kernel, and SonicWall
• Sept. 9, 2024 - Critical SonicWall SSLVPN bug exploited in ransomware attacks
• Sept. 9, 2024 - Akira Ransomware Actors Exploit SonicWall Bug for RCE
• Sept. 9, 2024 - Akira Ransomware Exploits SonicWall SSLVPN Flaw (CVE-2024-40766)

CVE-2024-29847

CRITICAL CVSS 9.80 EPSS Score 0.07 EPSS Percentile 31.65

Remote Code Execution Public Exploits Available

Published: Sept. 12, 2024

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

Vendor Impacted: Ivanti

Product Impacted: Endpoint Manager

Quotes

• Successful exploitation could lead to unauthorized access to the EPM core server
• We are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program
• Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution

Headlines

• Sept. 11, 2024 - Ivanti fixes critical vulnerabilities in Endpoint Management (CVE-2024-29847)
• Sept. 11, 2024 - Ivanti fixed a maximum severity flaw in its EPM software
• Sept. 10, 2024 - Ivanti fixes maximum severity RCE bug in Endpoint Management software
• Sept. 10, 2024 - Ivanti Issues Patch for Critical Vulnerabilities in Endpoint Manager, Including CVE-2024-29847 (CVSS 10.0)

CVE-2024-38018

HIGH CVSS 8.80 EPSS Score 0.05 EPSS Percentile 20.01

Remote Code Execution

Published: Sept. 10, 2024

Microsoft SharePoint Server Remote Code Execution Vulnerability

Quotes

• An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer
• Starting with the Windows security update released March 12, 2024 - KB5035858 (OS Build 10240.20526), the build version numbers crossed into a range that triggered a code defect in the Windows 10 (version 1507) servicing stack that handles the applicability of optional components

Headlines

• Sept. 11, 2024 - Microsoft broke Windows 10 patching, fixes exploited bugs
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score

CVE-2024-38014

HIGH CVSS 7.80 EPSS Score 0.06 EPSS Percentile 23.61

CISA Known Exploited Remote Code Execution

Published: Sept. 10, 2024

Windows Installer Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2016, Windows Server 2008, Windows 11 21h2, Windows 11 24h2, Windows 11 23h2, Windows Server 2022, Windows 11 22h2, Windows Server 2012, Windows 10 1507, Windows 10 22h2, Windows 10 1607, Windows Server 2022 23h2, Windows Server 2019, Windows 10 1809, Windows 10 21h2, Windows

Quotes

• The SetOpLock trick can pause the execution of the command
• To correct this issue, users need to apply both the September 2024 Servicing Stack Update and the September 2024 Windows Security Updates
• The size of this release tracks with the volume we saw from Redmond last month, but again, it’s unusual to see such a high number of bugs under active attack
• This vulnerability emerged due to a rollback of fixes for certain previously mitigated vulnerabilities following the installation of security updates from March to August 2024
• An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer
• Crossed into a range that triggered a code defect in the Windows 10 (version 1507) servicing stack that handles the applicability of Optional Components. As a result, any Optional Component that was serviced with updates released since March 12, 2024 (KB5035858) was detected as
• An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt

Headlines

• Sept. 12, 2024 - More details on that Windows Installer 'make me admin' hole
• Sept. 12, 2024 - September Patch Tuesday addresses 79 CVEs
• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

CVE-2024-41869

HIGH CVSS 7.80

Remote Code Execution

Published: Sept. 13, 2024

Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Quotes

• Users are highly encouraged to apply the new update as soon as possible
• I can confirm our Acrobat product team has identified a secondary fix that is required to fully address this issue
• I created EXPMON because I noticed that there were no sandbox-based detection and analysis systems specifically focusing on detecting threats from an exploit or vulnerability perspective
• Crossed into a range that triggered a code defect in the Windows 10 (version 1507) servicing stack that handles the applicability of Optional Components. As a result, any Optional Component that was serviced with updates released since March 12, 2024 (KB5035858) was detected as

Headlines

• Sept. 12, 2024 - Adobe fixes Acrobat 0-day as experts prepare exploit reveal
• Sept. 12, 2024 - Adobe completes fix for Reader bug with known PoC exploit (CVE-2024-41869)
• Sept. 12, 2024 - September Patch Tuesday addresses 79 CVEs
• Sept. 12, 2024 - Adobe Patch Tuesday security updates fixed multiple critical issues in company's products
• Sept. 11, 2024 - Adobe fixes Acrobat Reader zero-day with public PoC exploit

CVE-2023-27532

HIGH CVSS 7.50 EPSS Score 3.08 EPSS Percentile 91.23

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: March 10, 2023

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

Vendor Impacted: Veeam

Products Impacted: Veeam Backup \& Replication, Backup & Replication, Backup \& Replication

Quotes

• Believe with medium confidence that CosmicBeetle enrolled itself as a new RansomHub affiliate
• CosmicBeetle replaced its previously deployed ransomware, Scarab, with ScRansom, which is continually improved
• Seasoned gangs prefer to have their decryption process as easy as possible to increase the chances of correct decryption, which boosts their reputation and increases the likelihood that victims will pay

Headlines

• Sept. 12, 2024 - Amateurish 'CosmicBeetle' Ransomware Stings Turkish SMBs
• Sept. 12, 2024 - CosmicBeetle's ScRansom Ransomware: A Growing Threat to European and Asian Businesses
• Sept. 10, 2024 - CosmicBeetle Deploys Custom ScRansom Ransomware, Partnering with RansomHub
• Sept. 10, 2024 - NoName ransomware gang deploying RansomHub malware in recent attacks
• Sept. 9, 2024 - Veeam Backup & Replication RCE flaw may soon be leveraged by ransomware gangs (CVE-2024-40711)

CVE-2024-38226

HIGH CVSS 7.30 EPSS Score 0.05 EPSS Percentile 20.77

CISA Known Exploited

Published: Sept. 10, 2024

Microsoft Publisher Security Feature Bypass Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Publisher, Office

Quotes

• To correct this issue, users need to apply both the September 2024 Servicing Stack Update and the September 2024 Windows Security Updates
• Exploitation of both CVE-2024-38226 and CVE-2024-38217 can lead to the bypass of important security features that block Microsoft Office macros from running
• The size of this release tracks with the volume we saw from Redmond last month, but again, it’s unusual to see such a high number of bugs under active attack
• This vulnerability emerged due to a rollback of fixes for certain previously mitigated vulnerabilities following the installation of security updates from March to August 2024
• An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer
• Next we have CVE-2024-38226, another vulnerability that allows attackers to bypass a security feature. This vulnerability affects Microsoft Publisher, a standalone application that’s also included in some versions of Microsoft Office
• An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt

Headlines

• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 11, 2024 - Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws

CVE-2024-38217

MEDIUM CVSS 5.40 EPSS Score 0.27 EPSS Percentile 68.27

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Sept. 10, 2024

Windows Mark of the Web Security Feature Bypass Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2016, Windows Server 2008, Windows 11 21h2, Windows 11 24h2, Windows 11 23h2, Windows Server 2022, Windows 11 22h2, Windows Server 2012, Windows 10 1507, Windows 10 22h2, Windows 10 1607, Windows Server 2022 23h2, Windows Server 2019, Windows 10 1809, Windows 10 21h2, Windows

Quotes

• To correct this issue, users need to apply both the September 2024 Servicing Stack Update and the September 2024 Windows Security Updates
• Exploitation of both CVE-2024-38226 and CVE-2024-38217 can lead to the bypass of important security features that block Microsoft Office macros from running
• The size of this release tracks with the volume we saw from Redmond last month, but again, it’s unusual to see such a high number of bugs under active attack
• This vulnerability emerged due to a rollback of fixes for certain previously mitigated vulnerabilities following the installation of security updates from March to August 2024
• An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer
• To exploit this vulnerability, an attacker could host a file on an attacker-controlled server, then convince a targeted user to download and open the file. This could allow the attacker to interfere with the Mark of the Web functionality
• Crossed into a range that triggered a code defect in the Windows 10 (version 1507) servicing stack that handles the applicability of Optional Components. As a result, any Optional Component that was serviced with updates released since March 12, 2024 (KB5035858) was detected as
• An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt

Headlines

• Sept. 12, 2024 - September Patch Tuesday addresses 79 CVEs
• Sept. 11, 2024 - Microsoft Fixes Four Actively Exploited Zero-Days
• Sept. 11, 2024 - LNK Stomping (CVE-2024-38217): Microsoft Patches Years-Old Zero-Day Flaw
• Sept. 11, 2024 - Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days
• Sept. 11, 2024 - Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
• Sept. 10, 2024 - Bug Left Some Windows PCs Dangerously Unpatched –
• Sept. 10, 2024 - Microsoft Discloses 4 Zero-Days in September Update
• Sept. 10, 2024 - Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
• Sept. 10, 2024 - Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
• Sept. 10, 2024 - Microsoft fixes Windows Smart App Control zero-day exploited since 2018
• Sept. 10, 2024 - Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws