Microsoft shares mitigation for Office zero-day exploited in attacks.
Looking for:
Microsoft finally fixes Windows zero-day flaw exploited by state-backed hackers – TechCrunch - Plus: Intel, AMD react to Hertzbleed data-leaking holes in CPUs |
Microsoft fixes under-attack Windows 0-day Follina • The Register.Windows MSDT zero-day vulnerability gets free unofficial patch
In Windows, a protocol scheme can be registered for example martinz and associate an executable to handle this protocol. While it is triggered by an Office document, the Follina vulnerability is being exploited via one of these custom protocol schemes, used as part of the Windows Troubleshooting Platform WTP.
WTP was introduced in Windows 7 and Windows Server R2 as a way for users or 3 rd party applications to trigger troubleshooting scenarios and automatically fix various problems. There are different ways that the troubleshooting pack which is just a PowerShell code and manifest file can be executed.
It is available in GUI see screenshot below , the command line msdt. For example, if a tool for online collaboration is experiencing problems with audio, it can provide a user with a link to start audio troubleshooting. This parameter is not supposed to contain any PowerShell code, only the location of the file. This code is not executed by msdt. Instead, it is executed by sdiagnhost. As of May 31st , , Microsoft has released a security guidance note.
On June 14th, , Microsoft has released a patch to address this vulnerability. This is a critical security vulnerability, and we urge organizations to make sure all endpoints are up to date with the latest security updates applied and installed once the patch is available.
Various components from Bitdefender endpoint security can prevent and detect this vulnerability. Bitdefender core antimalware includes signatures for the following detections:. Bitdefender Advanced Threat Control behavior-based process monitor detects suspicious process behavior. This detection is effective not only for attacks triggered by Microsoft Office but also for other methods that try to weaponize msdt. Bitdefender IP and URL reputation service will also block connection attempts for remote template injection for known malicious sites.
Threat intelligence is also featured in our Bitdefender Managed Detection and Response offering. Microsoft released its second-biggest patchload of yesterday. The company shipped fixes for vulnerabilities on the August Patch Tuesday, which is almost thrice as big as the August Patch Tuesday and second only to the April Patch Tuesday in The August patchload is not only the second-largest one so far this year, but it also fixes the highest number of critical vulnerabilities: Compared to August, ten and four critical vulnerabilities were fixed in April and July Patch Tuesday, respectively.
Microsoft chose to keep the flaw unaddressed for almost 30 months. However, the advent of the zero-day vulnerability Follina patched in June in the Windows troubleshooting tool in May-June proved a wake-up call for the tech giant to fix the older one. Microsoft said CVE is being actively exploited in the wild, has a low attack complexity, and requires no privileges on the target system.
This is why patching it up should be prioritized, despite a lower CVSS score 7. An attacker simply needs to convince the target user to click on a specially crafted file that calls MSDT to run arbitrary code. Another vulnerability with a low attack complexity that requires no privileges and, unlike CVE, requires no user interaction is CVE It began in May when NFSv2 was fixed. Then in June, they fixed NFSv4. Now, NFSv4. Will they fix NFSv3 and v2 again in September? Once again, the two bugs require no user interaction or system privileges and have a low attack complexity, leading the SANS Internet Storm Center to believe they could be wormable.
Both of these RCE flaws can be rendered unexploitable by blocking traffic through port since this is the only one impacted.
However, Walter advises caution. But be careful, or it will cause your tunnels to fail to connect properly; do it wisely on both sides.
Windows troubleshooter zero day. Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability
Microsoft has patched the "Follina" Windows vulnerability that hackers are actively exploiting. At its core, the Follina zero-day vulnerability is made possible by custom protocol handlers in the Windows operating system. Custom protocol handlers often allow threat actors to exploit local vulnerabilities using the browser. In Windows, a protocol scheme can be registered for example martinz and associate an executable to handle this protocol.
While it is triggered by an Office document, the Follina vulnerability is being exploited via one of these custom protocol schemes, used as part of the Windows Troubleshooting Platform WTP.
WTP was introduced in Windows 7 and Windows Server R2 as a way for users or 3 rd party applications to trigger troubleshooting scenarios and automatically fix various problems. There are different ways that the troubleshooting pack which is just a PowerShell code and manifest file can be executed.
It is available in GUI see screenshot below , the command line msdt. For example, if a tool for online collaboration is experiencing problems with audio, it can provide a user with a link to start audio troubleshooting.
Newsletter Sign Up To receive periodic updates and news from BleepingComputer , please use the form below. Latest Downloads. Malwarebytes Anti-Malware Version: 4. Everything Desktop Search Version: 1. Zemana AntiLogger Free Version: 1. Login Username. Remember Me. Sign in anonymously. Sign in with Twitter Not a member yet? Reporter Help us understand the problem.
The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user's rights," MSRC said. Microsoft has also provided instructions for undoing the workaround. It recommends customers with Microsoft Defender Antivirus turn on cloud-delivered protection and automatic sample submission. Customers with Microsoft Defender for Endpoint for enterprise can enable the attack surface reduction rule 'BlockOfficeCreateProcessRule' that blocks Office apps from creating child processes.
Microsoft says its Defender Antivirus "provides detections and protections for possible vulnerability exploitation … using detection build 1. The signatures for the malicious files include:. However, it notes: "If the calling application is a Microsoft Office application, by default, Microsoft Office opens documents from the internet in Protected View or Application Guard for Office, both of which prevent the current attack. The bug also is present in most versions of Windows and Windows Server.
Microsoft has issued an advisory, but there is no patch available yet. Working exploit code is circulating and the exploitation attempts that have been seen so far mainly employ malicious Word documents.
Comments
Post a Comment