Microsoft’s August 2024 Patch Tuesday Addresses 10 Zero-Days, 6 Exploited

On Aug. 13, 2024, Microsoft released its latest batch of security updates as part of its Patch Tuesday program, addressing a total of 89 vulnerabilities across its products. Of particular concern this month are the 10 zero-day vulnerabilities that have been disclosed. Even more alarming, six of these zero-days have been actively exploited in the wild, meaning attackers have already leveraged these flaws in real-world scenarios. Read on to learn more.  

What are the zero-day vulnerabilities mentioned in Microsoft’s August 2024 Patch Tuesday?  

A zero-day vulnerability refers to a security flaw that is discovered by attackers before the software vendor becomes aware of it or has had the chance to fix it. These vulnerabilities are highly sought after by cybercriminals, as they offer a window of opportunity to exploit systems before defenses can be updated. The presence of six exploited zero-days in this update highlights the critical nature of this Patch Tuesday and underscores the importance of immediate action. 

The six zero-day vulnerabilities being actively exploited are as follows: 

• CVE-2024-38178 – Scripting Engine Memory Corruption Vulnerability: This vulnerability affects the scripting engine used in Microsoft’s browser components, allowing attackers to execute arbitrary code on the target system. 

• CVE-2024-38193 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability: This flaw in the WinSock driver could allow an attacker to gain elevated privileges, potentially leading to a complete system compromise. 

• CVE-2024-38213 – Windows Mark of the Web Security Feature Bypass Vulnerability: Attackers can exploit this vulnerability to bypass security features designed to protect users from untrusted files downloaded from the internet. 

• CVE-2024-38106 – Windows Kernel Elevation of Privilege Vulnerability: This kernel-level vulnerability could enable an attacker to execute code with higher privileges than originally intended, potentially leading to a full system takeover. 

• CVE-2024-38107 – Windows Power Dependency Coordinator Elevation of Privilege Vulnerability: This vulnerability, similar to the previous one, could allow for elevated privileges, increasing the potential impact of any attack. 

• CVE-2024-38189 – Microsoft Project Remote Code Execution Vulnerability: Exploiting this flaw could enable an attacker to execute remote code in the context of the application, posing significant risks to organizations using Microsoft Project. 

In addition to these six, Microsoft has disclosed four other zero-day vulnerabilities that, while not yet actively exploited, still pose significant risks if left unaddressed: 

• CVE-2024-38199 – Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability: This vulnerability affects the LPD service, which could allow an attacker to execute code remotely on affected systems. 

• CVE-2024-21302 – Windows Secure Kernel Mode Elevation of Privilege Vulnerability: This vulnerability could allow attackers to elevate their privileges, potentially leading to unauthorized access to sensitive data. 

• CVE-2024-38200 – Microsoft Office Spoofing Vulnerability: This flaw could be exploited by attackers to create phishing attacks that appear more legitimate by spoofing Microsoft Office. 

• CVE-2024-38202 – Windows Update Stack Elevation of Privilege Vulnerability: This vulnerability affects the update mechanism in Windows, potentially allowing attackers to gain elevated privileges during the update process. 

Given the critical nature of these vulnerabilities, it’s crucial that organizations prioritize the application of these patches as soon as possible. 

What is Nuspire doing? 

At Nuspire, we understand the urgency and potential impact of these vulnerabilities. We continuously monitor the threat landscape and apply patches in accordance with vendor recommendations. As part of our commitment to keeping our clients secure, we’ve already begun the process of applying the necessary updates across all managed environments. 

We emphasize the importance of timely patching because delays can leave systems exposed to significant risks, especially with vulnerabilities that are being actively exploited. By acting swiftly, we minimize the window of opportunity for attackers and ensure that our clients’ systems remain secure. 

What should I do? 

For organizations that manage their own IT environments, the August 2024 security updates from Microsoft should be reviewed and applied without delay. Prioritization is key: focus first on the six actively exploited zero-day vulnerabilities, as these pose the greatest immediate threat. 

Here are some steps you can take: 

1. Prioritize Patching: Begin by addressing the six zero-days that are actively being exploited. These vulnerabilities should be patched immediately to prevent potential breaches. 
2. Review CVEs: Go through the individual CVEs listed by Microsoft. For those that cannot be patched immediately, look for any available workarounds or mitigations. Implement these interim measures to reduce your exposure until a full patch can be applied. 
3. Test Patches in a Staging Environment: Before deploying patches across your entire network, it’s wise to test them in a controlled environment. This helps ensure that the patches don’t inadvertently disrupt operations or cause compatibility issues with existing applications. 
4. Communicate with Your Teams: Ensure that all relevant stakeholders are aware of the updates and understand the importance of applying them promptly. Clear communication can help prevent delays in the patching process. 
5. Monitor for Exploitation: Even after patching, keep an eye on your systems for any signs of exploitation. Attackers may have already compromised systems before patches were applied, so vigilance is necessary.

The August 2024 Patch Tuesday highlights the critical importance of staying ahead in vulnerability management to protect your organization from emerging threats. Nuspire’s comprehensive Vulnerability Management Services are designed to not only address these vulnerabilities but also enhance your overall security posture. Our services include continuous vulnerability scanning, strategic patch management, and expert security consulting tailored to your organization’s needs. 

Additionally, our Incident Response Readiness Service ensures that your team is prepared to tackle security incidents with speed and confidence. By partnering with Nuspire, you’ll gain the tools and expertise needed to minimize risks and maintain business continuity in the face of evolving cyber threats.