{"id":1128,"date":"2020-12-24T16:58:09","date_gmt":"2020-12-24T16:58:09","guid":{"rendered":"https:\/\/zerothcode.com\/blog\/?p=1128"},"modified":"2020-12-24T16:58:09","modified_gmt":"2020-12-24T16:58:09","slug":"google-discloses","status":"publish","type":"post","link":"https:\/\/zerothcode.com\/blog\/google-discloses\/","title":{"rendered":"Google Discloses Poorly-Patched, Now Unpatched, Windows 0-Day Bug"},"content":{"rendered":"

Google’s Project Zero team has made public details of an improperly patched zero-day security vulnerability in Windows print spooler API that could be leveraged by a bad actor to execute arbitrary code.<\/p>\n

Details of the unpatched flaw were revealed publicly after Microsoft failed to patch it within 90 days of responsible disclosure on September 24.<\/p>\n

Originally tracked as CVE-2020-0986, google<\/h5>\n

the flaw concerns an elevation of privilege exploits in the GDI Print \/ Print Spooler API (“splwow64.exe”) that was reported to Microsoft by an anonymous user working with Trend Micro’s Zero Day Initiative (ZDI) back in late December 2019.<\/p>\n

But with no patch in sight for about six months, ZDI ended up posting a public\u00a0advisory\u00a0as a zero-day on May 19 earlier this year,<\/p>\n

after which it was\u00a0exploited\u00a0in the wild in a campaign dubbed “Operation powerful” against an unnamed South Korean company.<\/p>\n

“splwow64.exe” is a Windows core system binary that allows 32-bit applications to connect with the 64-bit printer spooler service on 64-bit Windows systems.<\/p>\n

It implements a Local Procedure Call (LPC) server that can be used by other processes to access printing functions.<\/p>\n

\"\"<\/a><\/div>\n

Successful exploitation of this vulnerability could result in an attacker manipulating the memory of the “splwow64.exe” process to achieve execution of arbitrary code in kernel mode,<\/p>\n

ultimately using it to install malicious programs; view, change, or delete data; or create new accounts with full user rights.<\/p>\n

However, to achieve this, the adversary would first have to log on to the target system in question.<\/p>\n

Although Microsoft eventually\u00a0addressed\u00a0the shortcoming as part of its June Patch Tuesday update, new findings from Google’s security team reveals that the flaw has not been fully remediated.<\/p>\n

“The vulnerability still exists, just the exploitation method had to change,” Google Project Zero researcher Maddie Stone\u00a0said in a write-up.<\/p>\n

“The original issue was an arbitrary pointer dereference which allowed the attacker to control the src and dest pointers to a memcpy,” Stone\u00a0detailed.<\/p>\n

“The ‘fix’ simply changed the pointers to offsets, which still allows control of the args to the memcpy.”<\/p>\n

The newly reported elevation of privilege flaw, identified as CVE-2020-17008, is expected to be resolved by Microsoft on January 12, 2021, due to “issues identified in testing” after promising an initial fix in November.<\/p>\n

Stone has also shared a proof-of-concept (POC) exploit code for CVE-2020-17008, based on a POC released by Kaspersky for CVE-2020-0986.<\/p>\n

“There have been too many occurrences this year of zero-days known to be actively exploited being fixed incorrectly or incompletely,” Stone\u00a0said.<\/p>\n

“When [in the wild] zero-days aren’t fixed completely, attackers can reuse their knowledge of vulnerabilities and exploit methods to easily develop new 0-days.”<\/p>\n","protected":false},"excerpt":{"rendered":"

Google’s Project Zero team has made public details of an improperly patched zero-day security vulnerability in Windows print spooler API<\/p>\n","protected":false},"author":1,"featured_media":1129,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[37],"tags":[],"yst_prominent_words":[65,352,180,967],"class_list":["post-1128","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hackers-news"],"_links":{"self":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/1128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/comments?post=1128"}],"version-history":[{"count":0,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/1128\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media\/1129"}],"wp:attachment":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media?parent=1128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/categories?post=1128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/tags?post=1128"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/yst_prominent_words?post=1128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}