Tuesday’s patch bundle additionally mounted MiniPlasma, a separate vulnerability disclosed by Nightmare Eclipse. Microsoft mentioned in an e-mail that the vulnerability is tracked as CVE-2020-17103, a vulnerability Microsoft first mounted six years in the past. Meaning MiniPlasma was the results of a regression or an incomplete patch in its preliminary kind. The corporate is within the strategy of updating Tuesday’s bulletin to notice the republication.
Microsoft has but to launch patches for different vulnerabilities disclosed by Nightmare Eclipse. The corporate did present handbook directions for mitigating YellowKey, a vulnerability that permits attackers to defeat Bitlocker full-disk encryption. That could possibly be a boon when attackers have bodily entry to a tool (the exact situation Bitlocker is designed to guard in opposition to). The corporate has but to repair the underlying explanation for the vulnerability.
The standing of different vulnerabilities disclosed by Nightmare Eclipse are additionally unclear for the time being. The researcher named one vulnerability, current in Home windows Defender RedSun. One other, named BlueHammer, can also be an area privilege escalation flaw that gives SYSTEM rights.
Over the previous few months, Nightmare Eclipse has taken a number of potshots at Microsoft. The precise criticisms stay unclear, however many make references to complaints concerning the firm’s vulnerability disclosure program. Microsoft, in flip, has publicly railed in opposition to the researcher for “not responsibly” disclosing the vulnerabilities and made a vailed reference to the potential of pursuing authorized motion. After a public backlash, Microsoft later relented and vowed no such authorized motion would happen.
On Tuesday, Nightmare Eclipse revealed exploit code for a brand new Home windows vulnerability. It’s a race situation that targets Defender.
Tuesday’s patch batch included fixes for roughly 200 vulnerabilities. However the looks that MiniPlasma was mounted, two of them have been additionally confirmed as zero-days.
Submit up to date to incorporate info Microsoft supplied after preliminary publication of this submit.
