Third-Party Vendor Issues Temporary Patch For Windows Vulnerability (bleepingcomputer.com) 39
An anonymous reader writes: "A vulnerability discovered by Google Project Zero security researchers and left without a patch by Microsoft received a temporary fix from third-party security vendor ACROS Security," according to Bleeping Computer. Microsoft is set to officially patch the flaw on March 15, after it previously pushed back February's Patch Tuesday for next month.
"According to Google researchers, attackers could leverage malformed EMF files to expose data found in the victim's memory, which can then be leveraged to bypass ASLR protection and execute code on the user's computer... ACROS Security has issued a temporary patch that can be applied to Windows computers via its product, called 0patch, a platform that applies fixes for zero-days, unpatched vulnerabilities, end-of-life and unsupported products, for legacy OSes, vulnerable 3rd party components, and customized software." When Microsoft issues an official update, the temporary patch will stop working immediately.
"According to Google researchers, attackers could leverage malformed EMF files to expose data found in the victim's memory, which can then be leveraged to bypass ASLR protection and execute code on the user's computer... ACROS Security has issued a temporary patch that can be applied to Windows computers via its product, called 0patch, a platform that applies fixes for zero-days, unpatched vulnerabilities, end-of-life and unsupported products, for legacy OSes, vulnerable 3rd party components, and customized software." When Microsoft issues an official update, the temporary patch will stop working immediately.
Patch Not Needed (Score:1)
APK's HOSTS file will protect me.
Re: Patch Not Needed (Score:1)
Why do Microsoft push back a critical patch? (Score:4, Interesting)
did they get a court order from the NSA, because they need time to exploit it? Apple has done the same in the past, waiting up to 10 months fixing flaws that were critical, but had trivial solutions.
Re: (Score:3, Informative)
Because they need to make sure the patch won't screw up something else?
Or at least, that's one of the excuses they give.
Re: (Score:2)
Because patches need to be tested to make sure they don't break things. Trivial solutions may introduce side effects that break other things unexpectedly.
For an example, take Linux. You'd think everyone who uses Linux would install every update immediately (and there are lots that come out daily). But at work, w
EMF? (Score:2, Interesting)
How about locking it down to js, css, html, png, gif, and jpg?
What's next? Direct in-browser rendering and execution of exe, com , bat, pif, reg, and dll?
Re: (Score:1)
They can get rid of the JavaScript, too.
Re: (Score:1)
What's next? Direct in-browser rendering and execution of exe, com , bat, pif, reg, and dll?
That was called ActiveX.
Re: EMF? (Score:2)
So (Score:1)
Patch Tuesday is March 14, not 15 (Score:2)
Next Patch Tuesday is March 14. Let's not make it any later than it is.
Re: (Score:2)
Basically, pi day! :P
Re: patching without source code (Score:4, Informative)
So you have never changed a value in some binary to skip a routine or something? It is relatively easy to change a conditional jump to an unconditional jump or noop if you know a little reverse engineering, crackers used to do such things all the time to bypass things like disk checks.
Re: (Score:2)
https://null-byte.wonderhowto.... [wonderhowto.com]
Malformed EMF file? (Score:2)
That's unbelievable...
Re: (Score:2)
Why are people paying for windows again?
Because they do not have a choice.