The September Patch Tuesday addresses vulnerabilities in the following Microsoft products:

• Internet Explorer
• Microsoft Edge
• Microsoft Windows
• .NET Framework
• Skype for Business and Lync
• Microsoft Exchange Server
• Microsoft Office, Services, and Web Apps
• Adobe Flash Player

Some of the vulnerabilities have already been actively exploited by the attackers in the wild such as:

Windows .NET Framework Remote Code Execution (CVE-2017-8759) – It is a zero-day vulnerability that affects the way Microsoft .NET Framework processes untrusted input data.

The flaw could be exploited by an attacker to take full control of the vulnerable system simply by tricking victims into opening a specially crafted document or application sent over an email. The attacker can trigger the issue to create new accounts with full user rights.

According to FireEye, the CVE-2017-8759 has actively been exploited by an APT group to deliver the surveillance malware FinFisher Spyware (FinSpy) to a Russian-speaking “entity” via malicious Microsoft Office RTF files in July.

It was privately reported by security firm FireEye.

Device Guard Security Feature Bypass Vulnerability (CVE-2017-8746): This vulnerability could be exploited by attackers to inject malicious code into a Windows PowerShell session by bypassing the Device Guard Code Integrity policy.

Microsoft Edge Security Feature Bypass Vulnerability (CVE-2017-8723): This vulnerability affects Edge, it is related to the failure of Content Security Policy (CSP) in properly validating certain specially crafted documents. In order to exploit the vulnerability, an attacker just needs to trick victims into visiting a compromised website used to deliver malware.

Broadcom BCM43xx Remote Code Execution Vulnerability (CVE-2017-9417): This vulnerability resides in the Broadcom chipset in HoloLens, it could be exploited by attackers to send a specially crafted WiFi packet, enabling them to install programs, view, change, or delete data, even create new accounts with full admin rights.

…. and don’t forget the BlueBorne Attack!

The new attack technique, dubbed BlueBorne, was devised by experts with Armis Labs. Researchers have discovered a total of eight vulnerabilities in the Bluetooth design that expose devices to cyber attacks. Hackers can exploit the flaw to silently take control over a targeted Bluetooth-enabled device.

Microsoft also fixed four memory corruption and two remote code execution vulnerabilities in MS Office, five information disclosure and one denial of service flaws in Windows Hyper-V,  as well as two cross-site scripting (XSS) vulnerabilities in SharePoint.

Don’t waste time, be sure that September security patches are installed as soon as possible.

Pierluigi Paganini

(Security Affairs – September Patch Tuesday, Windows)

[adrotate banner=”5″]

[adrotate banner=”13″]