Security News > 2023 > May > Why Microsoft just patched a patch that squashed an under-attack Outlook bug
If a miscreant carefully crafted a mail with that sound path set to a remote SMB server, when Outlook fetched and processed the message, and automatically followed the path to the file server, it would hand over the user's Net-NTLMv2 hash in an attempt to log in.
The patch from a couple of months ago made Outlook use the Windows function MapUrlToZone to inspect where a notification sound path was really pointing, and if it was out to the internet, it would be ignored and the default sound would play.
The problem is that a maliciously constructed path can be passed to MapUrlToZone so that the function determines the path is not to the external internet when it really is when the application comes to open the path.
"An attacker can specify a UNC path that would cause the client to retrieve the sound file from any SMB server," he explained.
To find a bypass for Microsoft's original patch, Barnea wanted to craft a path that MapUrlToZone would label as local, intranet, or a trusted zone - meaning Outlook could safely follow it - but when passed to the CreateFile function to open, would make the OS go connect to a remote server.
Microsoft is recommending organizations fix both that vulnerability - a patch was issued as part of Patch Tuesday this week - as well as the earlier CVE-2023-23397.
News URL
https://go.theregister.com/feed/www.theregister.com/2023/05/12/microsoft_patches_second_flaw/
Related news
- Users call on Microsoft to update Outlook's friendly name feature (source)
- Critical Security Flaw in WhatsUp Gold Under Active Attack - Patch Now (source)
- Microsoft discloses Office zero-day, still working on a patch (source)
- Microsoft shares Outlook workaround for Gmail sign-in issues (source)
- Microsoft August 2024 Patch Tuesday fixes 9 zero-days, 6 exploited (source)
- Microsoft fixes 6 zero-days under active attack (source)
- Microsoft shares temp fix for Outlook, Word crashes when typing (source)
- Microsoft shares workaround for Outlook crashing after opening (source)
- Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws (source)
- Patch Tuesday for September 2024: Microsoft Catches Four Zero-Day Vulnerabilities (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-03-14 | CVE-2023-23397 | Authentication Bypass by Capture-replay vulnerability in Microsoft products Microsoft Outlook Elevation of Privilege Vulnerability | 9.8 |