Researchers disclose five Microsoft Windows zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0915 +1 in the same advisory: …0916 | An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, aka 'Windows GDI Elevation An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, aka 'Windows GDI Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0916. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2020-0986 | Windows Kernel Out-of-Bounds Write Enables Local Privilege Escalation (CVE-2020-0986) CVE-2020-0986 is an elevation of privilege vulnerability in the Microsoft Windows kernel caused by the kernel failing to properly handle objects in memory (classified as an out-of-bounds write, CWE-787). A local attacker who can already execute low-privileged code on a vulnerable machine can trigger the memory-corruption condition to elevate to SYSTEM/kernel-level privileges, gaining full read, write, and execution control over the system with no user interaction required. Affected deployments per the CPE data include Windows 8.1, Windows RT 8.1, Windows 10 versions 1507 through 2004, and Windows Server builds 1803 and 1903. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, while any association with ransomware remains unknown. EPSS rates a 15.9% probability of exploitation within 30 days (97th percentile), and Microsoft patched the flaw in its April 2020 monthly security updates alongside a batch of similar Windows kernel privilege escalation vulnerabilities. Do: Apply Microsoft security updates for every affected release without delay (the fix shipped in the April 2020 monthly security updates, and the CISA KEV required action is to update per vendor instructions); verify installed cumulative updates rather than relying on KB numbers alone. Because this is a local privilege escalation used for post-compromise elevation, prioritize endpoints and multi-user hosts (RDS/VDI, remote workers) where untrusted users or already-executed malware run locally. There is no reliable workaround for a kernel memory-handling flaw, so patching is the primary mitigation. | 7.8 | 16% | KEV |
| massorder of 10^8: plausibly hundreds of millions of Windows installations across the affected 2015-2020 builds |
Full article306 words · extracted from securityaffairs.com · click to collapse
Security experts have disclosed five unpatched vulnerabilities in Microsoft Windows, four of which rated as high-risk severity.
Security experts from Trend Micro’s Zero Day Initiative (ZDI) have published information on five unpatched vulnerabilities in Microsoft Windows.
Four vulnerabilities are classified as high-risk severity, three of them are zero-day vulnerabilities tracked as CVE-2020-0916, CVE-2020-0986, and CVE-2020-0915. The flaws could allow an attacker to escalate privileges on the affected system, they received a CVSS score of 7.0.
The vulnerabilities affect in the user-mode printer driver host process splwow64.exe, and is caused by the lack of validation for user-supplied input being dereferenced as a pointer.
The fourth issue affecting the user-mode printer driver host process splwow64.exe, tracked as CVE-2020-0915, is a low severity information disclosure vulnerability.
The issue is caused by the lack of validation of a user-supplied value before being dereferenced as a pointer.
ZDI reported the issue to Microsoft in December 2019, but the tech giant failed to address them with May 2020 Patch Tuesday.
The last zero-day vulnerability disclosed by Trend Micro’s Zero Day Initiative (ZDI) is a privilege escalation vulnerability in the handling of WLAN connection profiles.
“This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.” reads the advisory published by Trend Micro.
“The specific flaw exists within the user-mode printer driver host process splwow64.exe. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to escalate privileges from low integrity and execute code in the context of the current user at medium integrity.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Microsoft Windows, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/103507/hacking/microsoft-windows-zero-days.html