Security News > 2023 > May > Why Microsoft just patched a patch that squashed an under-attack Outlook bug

If a miscreant carefully crafted a mail with that sound path set to a remote SMB server, when Outlook fetched and processed the message, and automatically followed the path to the file server, it would hand over the user's Net-NTLMv2 hash in an attempt to log in.

The patch from a couple of months ago made Outlook use the Windows function MapUrlToZone to inspect where a notification sound path was really pointing, and if it was out to the internet, it would be ignored and the default sound would play.

The problem is that a maliciously constructed path can be passed to MapUrlToZone so that the function determines the path is not to the external internet when it really is when the application comes to open the path.

"An attacker can specify a UNC path that would cause the client to retrieve the sound file from any SMB server," he explained.

To find a bypass for Microsoft's original patch, Barnea wanted to craft a path that MapUrlToZone would label as local, intranet, or a trusted zone - meaning Outlook could safely follow it - but when passed to the CreateFile function to open, would make the OS go connect to a remote server.

Microsoft is recommending organizations fix both that vulnerability - a patch was issued as part of Patch Tuesday this week - as well as the earlier CVE-2023-23397.

News URL

https://go.theregister.com/feed/www.theregister.com/2023/05/12/microsoft_patches_second_flaw/