Security News > 2023 > May > Microsoft patches bypass for recently fixed Outlook zero-click bug
Microsoft fixed a security vulnerability this week that could be used by remote attackers to bypass recent patches for a critical Outlook zero-day security flaw abused in the wild.
"All Windows versions are affected by the vulnerability. As a result, all Outlook client versions on Windows are exploitable," Barnea explained.
The Outlook zero-day bug patched in March is a privilege escalation flaw in the Outlook client for Windows that enables attackers to steal NTLM hashes without user interaction in NTLM-relay attacks.
Threat actors can exploit it by sending messages with extended MAPI properties containing UNC paths to custom notification sounds, causing the Outlook client to connect to SMB shares under their control.
The threat actors used malicious Outlook notes and tasks to steal NTLM hashes by forcing their targets' devices to authenticate to attacker-controlled SMB shares.
Microsoft shares tips on detecting Outlook zero-day exploitation.
News URL
Related news
- Microsoft warns Gmail blocks some Outlook email as spam, shares fix (source)
- Surveillance by the New Microsoft Outlook App (source)
- Microsoft fixes Outlook security alerts bug caused by December updates (source)
- Microsoft squashes SmartScreen security bypass bug exploited in the wild (source)
- Microsoft pulls fix for Outlook bug behind ICS security alerts (source)
- Microsoft Outlook Flaw Exploited by Russia's APT28 to Hack Czech, German Entities (source)
- Microsoft shares temp fix for Outlook encrypted email reply issues (source)