using this format: What occurred: Microsoft addressed three actively exploited vulnerabilities in its latest Patch Tuesday for Windows.

Threat Vectors: Key vulnerabilities include:
CVE-2024-38014: Elevation of Privilege in Windows Installer.
CVE-2024-38217: Security Feature Bypass in Mark-of-the-Web.
CVE-2024-38226 & CVE-2024-43491: Security Feature Bypass in Microsoft Publisher and Remote Code Execution in Windows Update.

Breach Method: Attackers can exploit these vulnerabilities by convincing the target to open a specially crafted file from an attacker-controlled server or through local access for authenticated attackers.

Lessons Learned: Install September 2024 updates (SSU KB5043936 and KB5043083) to protect against these vulnerabilities.
use the same subheadings to summarize this article: VulnerabilitiesMicrosoft Says Recent Windows Vulnerability Exploited as Zero-Day
Microsoft warns that a recently patched Windows vulnerability was exploited in the wild as a zero-day prior to July 2024.


ByIonut Arghire
September 16, 2024
Flipboard

Reddit

Whatsapp

Email

Microsoft has raised the alarm on a second Windows vulnerability that was exploited as a zero-day to execute code through the disabled Internet Explorer browser.

The flaw, tracked as CVE-2024-43461, is a high-severity issue resolved with the September 2024 Patch Tuesday updates, more than two months after being exploited in the wild.

According to Microsoft, the security defect is a spoofing bug in MSHTML (MIME encapsulation of aggregate HTML documents), the underlying platform used in IE. While the browser has been retired, the platform is still present in Windows and is used by applications in certain circumstances.

Trend Micro’s Zero Day Initiative, which was credited for reporting the bug, explains that it allows attackers to execute arbitrary code if the user visits a malicious page or opens a malicious file.

“The specific flaw exists within the way Internet Explorer prompts the user after a file is downloaded. A crafted file name can cause the true file extension to be hidden, misleading the user into believing that the file type is harmless. An attacker can leverage this vulnerability to execute code in the context of the current user,” ZDI notes in an advisory.

On Friday, the tech giant updated its advisory for CVE-2024-43461 to warn that the vulnerability was exploited in attacks prior to July 2024 along with CVE-2024-38112, another MSHTML spoofing flaw.

“CVE-2024-43461 was exploited as a part of an attack chain relating to CVE-2024-38112, prior to July 2024. We released a fix for CVE-2024-38112 in our July 2024 security updates which broke this attack chain. Customers should install both the July 2024 and September 2024 security updates to fully protect themselves,” Microsoft notes.

According to a Trend Micro report, CVE-2024-38112 was exploited by an advanced persistent threat (APT) actor tracked as Void Banshee to execute code using the disabled IE.

Advertisement. Scroll to continue reading.
Industrial Cybersecurity Conference
The threat actor used crafted URLs that opened IE and redirected users to a compromised website hosting a malicious HTML Application (HTA) file that was executed to download a malicious payload in the background. The chain led to Atlantida stealer infections.