Security News > 2023 > May > Microsoft patches bypass for recently fixed Outlook zero-click bug
Microsoft fixed a security vulnerability this week that could be used by remote attackers to bypass recent patches for a critical Outlook zero-day security flaw abused in the wild.
"All Windows versions are affected by the vulnerability. As a result, all Outlook client versions on Windows are exploitable," Barnea explained.
The Outlook zero-day bug patched in March is a privilege escalation flaw in the Outlook client for Windows that enables attackers to steal NTLM hashes without user interaction in NTLM-relay attacks.
Threat actors can exploit it by sending messages with extended MAPI properties containing UNC paths to custom notification sounds, causing the Outlook client to connect to SMB shares under their control.
The threat actors used malicious Outlook notes and tasks to steal NTLM hashes by forcing their targets' devices to authenticate to attacker-controlled SMB shares.
Microsoft shares tips on detecting Outlook zero-day exploitation.
News URL
Related news
- Microsoft fixes Outlook drag-and-drop broken by Windows updates (source)
- Microsoft says button to restore classic Outlook is broken (source)
- Microsoft Exchange Online outage affects Outlook web users (source)
- Microsoft fixes button that restores classic Outlook client (source)
- New Windows 11 trick lets you bypass Microsoft Account requirement (source)
- Windows 11 Forces Microsoft Account Sign In & Removes Bypass Trick Option (source)
- Week in review: Microsoft patches exploited Windows CLFS 0-day, WinRAR MotW bypass flaw fixed (source)