Google 0-Day Hunters Uncovering 'Crazy Bad' Windows Rce Flaw

Update (Monday, May 08, 2017): Microsoft has released an emergency safety update to acre below-reported crazy bad remote code execution vulnerability inward its Microsoft Malware Protection Engine (MMPE) that affects Windows 7, 8.1, RT too 10 computers, too every bit Windows Server 2016 operating systems.

Google Project Zero's safety researchers convey discovered roughly other critical remote code execution (RCE) vulnerability inward Microsoft’s Windows operating system, claiming that it is something really bad.

Tavis Ormandy announced during the weekend that he too roughly other Project Zero researcher Natalie Silvanovich discovered "the worst Windows remote code [execution vulnerability] inward recent memory. This is crazy bad. Report on the way."

Ormandy did non render whatsoever farther details of the Windows RCE bug, every bit Google gives a 90-day safety disclosure deadline to all software vendors to acre their products too unwrap it to the public.

This agency the details of the novel RCE vulnerability inward Windows volition probable endure disclosed inward ninety days from right away fifty-fifty if Microsoft fails to acre the issue.

However, Ormandy afterwards revealed roughly details of the Windows RCE flaw, clarifying that:

• The vulnerability they claimed to convey discovered plant against default Windows installations.
• The assailant does non remove to endure on the same local expanse network (LAN) every bit the victim, which agency vulnerable Windows computers tin endure hacked remotely.
• The assail is "wormable," capability to spread itself.

Despite non fifty-fifty releasing whatsoever technical details on the RCE flaw, roughly IT professionals working for corporates convey criticized the Google Project Zero researcher for making the existence of the vulnerability public, piece Twitter's infosec community is happy amongst the work.

"If a tweet is causing panic or confusion inward your organization, the work isn't the tweet, the work is your organization," Project Zero researcher Natalie Silvanovich tweeted.

This is not the commencement time when Google's safety researchers convey discovered flaws inward Microsoft’s products. Most of late inward February, Google researchers disclosed the details of an unpatched vulnerability impacting Microsoft's Edge too Internet Explorer browsers.

Microsoft released a acre every bit role of its side past times side Patch Tuesday exactly criticized Google for making all details public, exposing millions of its Windows users at adventure of existence hacked.

Microsoft has non all the same responded to the latest claims, exactly the companionship has its May 2017 Patch Tuesday scheduled tomorrow, May 9, too thence hopefully, it volition include a safety acre to resolve this issue.

Share This :