A new Windows 7 and 8.1 vulnerability has been disclosed by Google, leaving Microsoft's operating systems exposed until next month, when the company plans to release a patch.
Η Google started in July of 2014 Project Zero group which chases zero-day on various platforms. Since then, they have exposed several Windows vulnerabilities. In the context of 90's policy of publicizing XNUMX days with the Project Zero team, Microsoft has been uncovered at least twice to date.
Basically, Google gives companies three months to resolve the security issues they discovered before disclosing them. To date, Google security bugs have revealed multiple security vulnerabilities in Windows.
The flaw disclosed today affects the mode των Windows που ονομάζεται “CryptProtectMemory” και επιτρέπει στις εφαρμογές για να κρυπτογραφήσουν τη μνήμη for running processes, during a connection.
When connected, the encryption key is issued based on the session ID and can be used to exchange data between processes by allowing the session ID to be derived from the symbolic impersonation, James Forshaw in the publication that reveals vulnerability.
The issue is that CNG.sys does not check the token impersonation level when receiving a login ID (using SeQueryAuthenticationIdToken). This way an ordinary user can mimic the level of authentication and decrypt or encrypt the data for that login session. ” says the researcher.
Forshaw also released one evidence of vulnerability (PoC) which proves that disclosure of information is possible by exploiting the flaw.
The problem was reported to Microsoft on 17 October of 2014. The company then confirmed the vulnerability in October 29 when developers managed to replicate it.
It is important to note that vulnerability had a specified disclosure date for January 15.
Ωστόσο, η εταιρεία ανακοίνωσε στη Google ότι δεν θα είναι σε θέση να παραδώσει ένα patch μέσα στον Ιανουάριο, επειδή προέκυψε πρόβλημα συμβατότητας. Έτσι η ενημέρωση που διορθώνει το security gap will be released next month.
