Windows 10 has another zero-day vulnerability, as discovered by a security researcher who specializes in finding bugs in Microsoft’s operating system – and has previously publicly outed them without warning before.
The unpatched vulnerability highlighted by SandboxEscaper has been confirmed to work on Windows 10 (32-bit) systems, as reported by
ZDNet. Furthermore, with some tweaking, it could theoretically be leveraged against any version of Windows (going as far back as Windows XP).
Utilizing a bug in the Task Scheduler in Windows, this is a local privilege escalation security flaw, meaning it can be used by a hacker to raise an account with low-level privileges on a PC to a full admin account (in other words, allowing them to do anything on the victim’s computer).
Note, however, that this security flaw can’t be used to gain access to a PC. It’s an exploit for malicious parties who have already hacked their way onto a computer, and a way for them to subsequently elevate their privileges to be able to do more.
Even so, this is obviously something Microsoft needs to address swiftly, and will perhaps be patched in the next round of security updates to arrive in June.
More where that came from
As we mentioned at the outset, SandboxEscaper is renowned for being a thorn in Microsoft’s side, and in October 2018 she released details of a bug that can also be abused to elevate privileges on a system, and
drew attention to a similar flaw back in August 2018.
More worryingly, she has also claimed that she’s found four further unpatched bugs in Windows, so we can expect more revelations in the pipeline fairly soon, no doubt.
SandboxEscaper previously highlighted these bugs on Twitter, but seemingly has had several of her Twitter accounts suspended in the past.
The unpatched vulnerability highlighted by SandboxEscaper has been confirmed to work on Windows 10 (32-bit) systems, as reported by
ZDNet. Furthermore, with some tweaking, it could theoretically be leveraged against any version of Windows (going as far back as Windows XP).
Utilizing a bug in the Task Scheduler in Windows, this is a local privilege escalation security flaw, meaning it can be used by a hacker to raise an account with low-level privileges on a PC to a full admin account (in other words, allowing them to do anything on the victim’s computer).
Note, however, that this security flaw can’t be used to gain access to a PC. It’s an exploit for malicious parties who have already hacked their way onto a computer, and a way for them to subsequently elevate their privileges to be able to do more.
Even so, this is obviously something Microsoft needs to address swiftly, and will perhaps be patched in the next round of security updates to arrive in June.
More where that came from
As we mentioned at the outset, SandboxEscaper is renowned for being a thorn in Microsoft’s side, and in October 2018 she released details of a bug that can also be abused to elevate privileges on a system, and
drew attention to a similar flaw back in August 2018.
More worryingly, she has also claimed that she’s found four further unpatched bugs in Windows, so we can expect more revelations in the pipeline fairly soon, no doubt.
SandboxEscaper previously highlighted these bugs on Twitter, but seemingly has had several of her Twitter accounts suspended in the past.
No comments:
Post a Comment