Five zero-days to be fixed on October Patch Tuesday

Monitoring and blocking

Breen added that those not able to deploy the patch right away should consider adding further monitoring and blocking rules targeting .msc files – the fix deployed also prevents these from executing on the system.

Meanwhile, Breen’s colleague, Nikolas Cemerikic, cyber security engineer at Immersive Labs, ran the rule over CVE-2024-45373. “The vulnerability allows an attacker to trick users into viewing malicious web content, which could appear legitimate due to the way the platform handles certain web elements,” he said.

“Once a user is deceived into interacting with this content, typically through phishing attacks, the attacker can potentially gain unauthorised access to sensitive information or manipulate web-based services. Importantly, this attack requires no special permissions or knowledge of the user’s system, making it relatively easy for cyber criminals to execute.”

Though rated lower in severity, it is already being exploited, which makes it a serious concern for large organisations, particularly those running a lot of legacy web applications – the MSHTML platform underpins the now-retired Internet Explorer, for example – which is still widely used for compatibility reasons.

This, said Cemerikic, creates risk for employees using older systems in their everyday work, “especially if they are accessing sensitive data or performing financial transactions online”.

Curl up and die

The three other publicly disclosed bugs comprise CVE-2024-6197, an RCE issue in Open Source Curl; CVE-2024-20659 a security feature bypass issue in Windows Hyper-V; and CVE-2024-43583, an elevation of privilege vulnerability in Winlogon. All three carry CVSS scores of between seven and eight, but none are yet known to be exploited.

The first of these, affecting the widely used open source Curl library, stems from an issue that arises when memory not allocated on the heap is improperly freed, leading to weird behaviour that can be exploited to execute code, explained Mike Walters, president and co-founder of Action1.

Walters said this was particularly concerning as it impacts the fundamental architecture of memory management in Curl, which is integral to data transfers in multiple network protocols. While Windows doesn’t typically ship with the Curl library, it does include its command line tool, hence the alert.

“Possible consequences of exploiting this vulnerability include execution of remote code on the client system by an attacker; compromised systems becoming gateways for data exfiltration or further network infiltration, [and] full control over the affected client, potentially leading to widespread malware distribution or misuse,” said Walters.

“Attackers could use this vulnerability to conduct man-in-the-middle [MitM] attacks by redirecting client requests to malicious servers,” he said. “If combined with vulnerabilities that allow for network lateral movement, this could significantly enhance an attacker’s capability to infiltrate and control vast portions of an enterprise’s network.

“Given Curl’s prevalence across both open-source and proprietary systems, its footprint is vast.”

The Winlogon EoP flaw, meanwhile, stems from improper handling of processes during the system login phase, and is facilitated by underlying weaknesses in how Winlogon interacts with Input Method Editors (IMEs), especially third-party ones.

“This vulnerability could be used in a multi-step attack, where initial access might be obtained through another local exploit or social engineering tactics,” said Walters. “Once remote attackers gain local access, leveraging this EoP vulnerability could enable deeper penetration into secured environments.

“Organisations using Windows systems are at significant risk, especially those that utilise third-party IMEs for linguistic or regional purposes,” he added. “This vulnerability is particularly pertinent in diverse settings where multilingual support is crucial, such as in global enterprises or educational institutions.”

As to the third, Hyper-V vulnerability, the good news is this may be somewhat less impactful, although this does not make it by any means less worthy of attention, as Tyler Reguly, Fortra associate director of security research and development, explained.

“Thankfully … there are a number of criteria that make it less likely that we’ll see this vulnerability exploited,” he said.

“Microsoft indicates that only certain hardware is impacted, which could allow the bypass of UEFI and lead to a compromise of the hypervisor, this would require that the system first be rebooted and that the attacker have access to the local network, as Microsoft has marked the attack vector in the CVSS score with the rarely seen adjacent value meaning the attack must originate from the same physical or logical network.”