Microsoft finally patches nasty Windows security hole, two years later
source link: https://www.techradar.com/news/microsoft-finally-patches-nasty-windows-security-hole-two-years-later
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Microsoft finally patches nasty Windows security hole, two years later
(Image credit: 123RF)
DogWalk, a security flaw in Windows first discovered in January 2020, has finally been addressed, the company has confirmed.
The remote code execution flaw, existing due to a path traversal weakness in the Windows Support Diagnostic Tool (MSDT), is being patched (opens in new tab) as part of the August 2022 Patch Tuesday, Microsoft has said.
The flaw is tracked as CVE-2022-34713, and if abused, can give attackers the ability to run any code on a target endpoint. It was first discovered by a researcher called Imre Rad more than two years ago, but back then, Microsoft said it wasn’t really a security vulnerability, and as such, it won’t be fixed. Fast forward to today, and the flaw has been put back into the spotlight by a different researcher, going by the name j00sean.
Abusing DogWalk on Windows 11
To exploit DogWalk, the attacker needs to add a malicious executable to the Windows Startup. That way, once the system is restarted, malware gets downloaded and run. It can be used in low-complexity attacks, but with a caveat - the victim needs to interact with the system (they need to download the malware or run it themselves).
"In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file," Microsoft said. "In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability."
DogWalk can be abused on all supported versions of Windows, Microsoft confirmed, including the latest variants - Windows 11, and Windows Server 2022.
This month’s Patch Tuesday also addresses CVE-2022-30134, a zero-day vulnerability affecting Microsoft Exchange Information Disclosure, which allows threat actors to read targeted email messages. In total, 112 flaws were addressed, including 17 deemed critical.
- These are the best endpoint protection (opens in new tab) services right now
Via: BleepingComputer (opens in new tab)
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK