'

Zero-day vulnerability uncovered on Windows

This bug has nothing to do with Spectre and meltdown

Zero-day vulnerability uncovered on Windows

Zero-day vulnerability uncovered on Windows 

2018 has been filled with hardware exploits and OS updates, most of which are related to Spectre, Meltdown or other side-channel hardware attacks. So far, Microsoft has stayed on top of the onslaught of Spectre, but now the company has been caught with its pants down as a new zero-day vulnerability comes to light.  

This vulnerability can allow local users to gain elevated system privileges. The vulnerability was uncovered by Twitter user @SandboxEscaper, who uploaded proof of concept code onto GitHub and expressed dissatisfaction towards Microsoft's bug/vulnerability submission process. 

So far, CERT/CC has analysed the vulnerability and has confirmed its functionality on Windows 10 64-bit and Windows Server 2016, stating that other Windows versions could be affected using modified versions of the now publically available proof of concept code. 

Below is an overview and description of the exploit from CERT/CC;

 

     Overview

Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the Advanced Local Procedure Call (ALPC) interface, which can allow a local user to obtain SYSTEM privileges.

Description

Microsoft Windows task scheduler contains a vulnerability in the handling of ALPC, which can allow a local user to gain SYSTEM privileges. We have confirmed that the public exploit code works on 64-bit Windows 10 and Windows Server 2016 systems. Compatibility with other Windows versions may be possible with modification of the publicly-available exploit source code.

Impact

A local user may be able to gain elevated (SYSTEM) privileges.

Solution

The CERT/CC is currently unaware of a practical solution to this problem.

 

 When The Register contacted Microsoft, the company stated that they would "proactively update impacted devices as soon as possible". The company expected to release an update sometime during their Patch Tuesday schedule. 
    

Zero-day vulnerability uncovered on Windows  

Microsoft's statement is extremely unclear, as patch Tuesday could refer to any Tuesday in the coming month, potentially leaving PCs vulnerable in the meantime. Even so, the public reveal of the vulnerability will no doubt speed up Microsoft's efforts to address the issue, and perhaps convince the company to streamline their bug submission program to prevent future zero-day bug reveals. 

You can join the discussion on Windows 10 getting hit by a Zero-day vulnerability on the OC3D Forums

«Prev 1 Next»

Most Recent Comments

28-08-2018, 12:42:28

looz
It's a local privilege escalation, I don't think we'll ever run out of those with a codebase as large as Windows 10's. Quote

28-08-2018, 15:51:29

Dawelio
What does ”zero-day” mean?...Quote

28-08-2018, 16:19:45

looz
Quote:
Originally Posted by Dawelio View Post
What does ”zero-day” mean?...
Essentially it means that it was in the wild before being brought to Microsoft's attention, so any hackers who know about it can abuse it freely.Quote

28-08-2018, 16:51:25

Dawelio
Quote:
Originally Posted by looz View Post
Essentially it means that it was in the wild before being brought to Microsoft's attention, so any hackers who know about it can abuse it freely.
Right... so I sort of get it, but at the same time, I don't Quote

28-08-2018, 17:16:31

SuB
Quote:
Originally Posted by Dawelio View Post
Right... so I sort of get it, but at the same time, I don't
http://bfy.tw/JchLQuote
Reply
x

Register for the OC3D Newsletter

Subscribing to the OC3D newsletter will keep you up-to-date on the latest technology reviews, competitions and goings-on at Overclock3D. We won't share your email address with ANYONE, and we will only email you with updates on site news, reviews, and competitions and you can unsubscribe easily at any time.

Simply enter your name and email address into the box below and be sure to click on the links in the confirmation emails that will arrive in your e-mail shortly after to complete the registration.

If you run into any problems, just drop us a message on the forums.