Security News > 2022 > December > Critical Microsoft Code-Execution Vulnerability
A critical code-execution vulnerability in Microsoft Windows was patched in September.
Like EternalBlue, CVE-2022-37958, as the latest vulnerability is tracked, allows attackers to execute malicious code with no authentication required.
Which could be exploited when using only the SMB, or server message block, a protocol for file and printer sharing and similar network activities, this latest vulnerability is present in a much broader range of network protocols, giving attackers more flexibility than they had when exploiting the older vulnerability.
At the time Microsoft researchers believed the vulnerability allowed only the disclosure of potentially sensitive information.
Microsoft gave the vulnerability a designation of "Important." In the routine course of analyzing vulnerabilities after they're patched, Palmiotti discovered it allowed for remote code execution in much the way EternalBlue did.
Last week, Microsoft revised the designation to critical and gave it a severity rating of 8.1, the same given to EternalBlue.
News URL
https://www.schneier.com/blog/archives/2022/12/critical-microsoft-code-execution-vulnerability.html
Related news
- Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability (source)
- March 2024 Patch Tuesday: Microsoft fixes critical bugs in Windows Hyper-V (source)
- Microsoft's March Updates Fix 61 Vulnerabilities, Including Critical Hyper-V Flaws (source)
- Critical FortiClient EMS vulnerability fixed, (fake?) PoC for sale (CVE-2023-48788) (source)
- Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool (source)
- PoC exploit for critical Fortra FileCatalyst MFT vulnerability released (CVE-2024-25153) (source)
- Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability (source)
- Critical Unpatched Ray AI Platform Vulnerability Exploited for Cryptocurrency Mining (source)
- CISA Warns: Hackers Actively Attacking Microsoft SharePoint Vulnerability (source)
- Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2022-09-13 | CVE-2022-37958 | Unspecified vulnerability in Microsoft products SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability | 8.1 |