fbpx
Connect with us

Tech

Microsoft fixes two-year-old MSDT vulnerability in August update

Published

on

Microsoft fixes two-year-old MSDT vulnerability in August update

August’s Patch Tuesday drop fixes more than 120 CVEs, including another MSDT RCE zero-day that is being actively exploited.

Alex Scroxton

By

Published: 10 Aug 2022 12:45

Two-and-a-half years after a security researcher publicly disclosed the existence of a remote code execution (RCE) zero-day vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT), dubbed DogWalk, Microsoft has finally issued a fix for the problem after a new variant emerged, having previously not done so on the basis that it did not meet the right criteria.

Tracked as CVE-2022-34713, successful exploitation requires the victim to be convinced to open a specially crafted file, which can be delivered either via email or an attacker-controlled or compromised website. As such, it is rated merely important as opposed to critical.

This is the second major MSDT vulnerability to have been fixed by Microsoft in the past few months, following the disclosure of the dangerous Follina zero-day at the end of May, which was patched in June.

“With reports that CVE-2022-34713 has been exploited in the wild, it would appear that attackers are looking to take advantage of flaws within MSDT as these types of flaws are extremely valuable to launch spear phishing attacks,” said Tenable senior staff research engineer Satnam Narang.

“A variety of threat actors leverage spear phishing, from advanced persistent threat (APT) groups to ransomware affiliates,” he said. “For attackers, bugs that can be executed via malicious documents remain a valuable tool, so flaws like Follina and CVE-2022-34713 will continue to be used for months. Therefore, it is vital that organisations apply the available patches as soon as possible.”

Qualys director of vulnerability and threat research Bharat Jogi added: “The DogWalk zero-day vulnerability is not new to the industry. It was initially reported back in 2019, but not deemed a vulnerability as it was believed to require significant user interaction to exploit, and there were various other mitigations in place.

“However, as we see today’s bad actors growing more sophisticated and creative in their exploits, a recent zero-day that leveraged the ms:msdt protocol URI scheme (Follina) forced MSFT to reconsider DogWalk as a vulnerability,” he said. “Follina has been recently used by threat actors – for example, Chinese APT TA413 – in phishing campaigns that have targeted local US and European government personnel, as well as a major Australian telecommunications provider. Successful exploitation of this vulnerability allows an attacker to deploy malware and gain foothold on a system.”

The August update fixes a larger-than-average total of 121 vulnerabilities, 17 of them classed as critical – likely in part due to disclosures and proof-of-concept exploits to be shown off at Black Hat USA and the upcoming DEF CON hacker event.

Of the critical vulnerabilities, two of the most severe appear to be CVE-2022-30133 and CVE-2022-35744, both of which are RCE vulnerabilities affecting Windows Point-to-Point Protocol, and both of which carry CVSS scores of 9.8, although neither has been made public or exploited. A full breakdown of this month’s critical vulnerabilities is available from the Zero Day Initiative.

Also particularly noteworthy is a publicly disclosed but not-yet-exploited information disclosure vulnerability affecting Exchange Server, tracked as CVE-2022-30134. Greg Wiseman, lead product manager at Rapid7, explained its significance:

“In this case, simply patching is not sufficient to protect against attackers being able to read targeted email messages,” he said. “Administrators should enable Extended Protection in order to fully remediate this vulnerability, as well as the five other vulnerabilities affecting Exchange this month. Details about how to accomplish this are available via the Exchange Blog.”





Read more on Application security and coding requirements

Go to Source

Click to comment

Leave a Reply

Tech

USB logos finally make sense, thanks to a redesign

Published

on

USB logos finally make sense, thanks to a redesign

, Senior Editor

As PCWorld’s senior editor, Mark focuses on Microsoft news and chip technology, among other beats. He has formerly written for PCMag, BYTE, Slashdot, eWEEK, and ReadWrite.

Go to Source

Continue Reading

Tech

Cheaper OLED monitors might be coming soon

Published

on

Cheaper OLED monitors might be coming soon

, Staff Writer

Michael is a former graphic designer who’s been building and tweaking desktop computers for longer than he cares to admit. His interests include folk music, football, science fiction, and salsa verde, in no particular order.

Go to Source

Continue Reading

Tech

NASA Says Hurricane Didn’t Hurt Artemis I Hardware, Sets New Launch Window

Published

on

NASA Says Hurricane Didn’t Hurt Artemis I Hardware, Sets New Launch Window

NASA’s Artemis I moon mission launch, stalled by Hurricane Ian, has a new target for takeoff. The launch window for step one of NASA’s bold plan to return humans to the lunar surface now opens Nov. 12 and closes Nov. 27, the space agency said Friday. 

The news comes after the pending storm caused NASA to scrub the latest Artemis I Iaunch, which had been scheduled for Sunday, Oct. 2. As Hurricane Ian threatened to travel north across Cuba and into Florida, bringing rain and extreme winds to the launch pad’s vicinity, NASA on Monday rolled its monster Space Launch System rocket, and the Orion spacecraft it’ll propel, back indoors to the Vehicle Assembly Building at Florida’s Kennedy Space Center. 

The hurricane made landfall in Florida on Wednesday, bringing with it a catastrophic storm surge, winds and flooding that left dozens of people dead, caused widespread power outages and ripped buildings from their foundations. Hurricane Ian is “likely to rank among the worst in the nation’s history,” US President Joe Biden said on Friday, adding that it will take “months, years, to rebuild.”

Initial inspections Friday to assess potential impacts of the devastating storm to Artemis I flight hardware showed no damage, NASA said. “Facilities are in good shape with only minor water intrusion identified in a few locations,” the agency said in a statement. 

Next up, teams will complete post-storm recovery operations, which will include further inspections and retests of the flight termination system before a more specific launch date can be set. The new November launch window, NASA said, will also give Kennedy employees time to address what their families and homes need post-storm. 

Artemis I is set to send instruments to lunar orbit to gather vital information for Artemis II, a crewed mission targeted for 2024 that will carry astronauts around the moon and hopefully pave the way for Artemis III in 2025. Astronauts on that high-stakes mission will, if all goes according to plan, put boots on the lunar ground, collect samples and study the water ice that’s been confirmed at the moon’s South Pole. 

The hurricane-related Artemis I rollback follows two other launch delays, the first due to an engine problem and the second because of a hydrogen leak.

Hurricane Ian has been downgraded to a post-tropical cyclone but is still bringing heavy rains and gusty winds to the Mid-Atlantic region and the New England coast.

Go to Source

Continue Reading
Home | Latest News | Tech | Microsoft fixes two-year-old MSDT vulnerability in August update
a

Market

Trending