Rumor: Microsoft might share information on extremely critical vulnerability later today

Evildead666

2020-01-14 14:57

Could it have something to do with Windows 7 ? now its officially EOL, maybe they'll admit there's a huge gaping hole, that they won't be closing, or can't close.....

#5750605

Hilbert Hagedoorn

Administrator

2020-01-14 15:02

Nah, it coincides with patch Tuesday and the EOL of Windows 7 was already planned years ago. If it is as bad as this sounds, then MS will certainly push another patch update for W7.

#5750606

asturur

2020-01-14 15:06

Also because if is really 20 years old hole... They do not want to be responsible for open doors in a still large population of computers.

#5750610

schmidtbag

2020-01-14 15:14

@Will Dormann I get the impression that MS developers should pay closer attention to how they implement security. I don't know... just call it the bare minimum?

#5750612

geogan

2020-01-14 15:29

Evildead666:

Could it have something to do with Windows 7 ? now its officially EOL, maybe they'll admit there's a huge gaping hole, that they won't be closing, or can't close.....

Can't close?? It's a single DLL file. All you would have to do is copy over the newer patched file version surely? (Unless the OS won't allow computer admin to overwrite that file)

#5750617

Rich_Guy

2020-01-14 15:34

As long as they fix it :P

#5750618

Texter

2020-01-14 15:35

Yeah as long as they fix it without breaking something else;)

#5750623

Rich_Guy

2020-01-14 16:01

Texter:

Yeah as long as they fix it without breaking something else;)

Yup 😀

#5750624

SamuelL421

2020-01-14 16:03

Hilbert Hagedoorn:

Nah, it coincides with patch Tuesday and the EOL of Windows 7 was already planned years ago. If it is as bad as this sounds, then MS will certainly push another patch update for W7.

I hope this is true, but I am not so certain. MS has been very vocal the past few weeks about the continued support / patches only being made available to businesses and 365 subscribers who are licensed for the extended support 🙁

#5750627

Crazy Joe

2020-01-14 16:09

Any idea when the patches for Patch Tuesday are supposed to drop? For me this Tuesday is already 2/3's over!

#5750633

Rich_Guy

2020-01-14 16:33

Here in the UK, its 6pm.

#5750634

Hilbert Hagedoorn

Administrator

2020-01-14 16:37

Crazy Joe:

Any idea when the patches for Patch Tuesday are supposed to drop? For me this Tuesday is already 2/3's over!

To the best of my knowledge at 7pm CET.

#5750640

Yxskaft

2020-01-14 16:51

SamuelL421:

I hope this is true, but I am not so certain. MS has been very vocal the past few weeks about the continued support / patches only being made available to businesses and 365 subscribers who are licensed for the extended support 🙁

Though Microsoft has shown they can patch if they deem it critical enough. Even though XP was dead, they did release an update against the Wannacry vulnerability, as well as the Remote Desktop vulnerability this year.

#5750652

Kaarme

2020-01-14 17:25

It would not do any good for Microsoft not to release extremely significant security patches for Win7 even a while after the supporting ending deadline. MS itself relies on the web a lot, so botnets are their enemy as well. Not to mention it'd bad for their PR if this became a real plague due to not patching it. If news sites report there's a hundred thousand PC Win7 botnet that MS could have prevented with a simple patch, yet refused to, what would people think? Well, Linux people would snicker.

#5750653

barbacot

2020-01-14 17:30

Cryptography...hmmm... I will leave my wife's computer without patch - maybe someone will steal the parts of her identity that annoy me...

#5750655

Gomez Addams

2020-01-14 17:35

"According to Krebs On Security, Microsoft is about to release an extremely critical vulnerability in Windows." I seriously doubt that is really what they are going to release.

#5750669

JonasBeckman

2020-01-14 18:06

Well they do want people to use the newest build so maybe that'd do it... What will they fix though the ease of which one bypasses the activation requirements? 😛 (Well it's probably quite important but I guess we'll get some details in a hour or so when the update is actually out.) EDIT: Sides they've been handing out free system upgrades for users on W7 way after the initial time period for that was out so yeah it's probably something quite important then. Now what is it and what will it do to overall system performance. 😀 (Eh it's probably not too bad in that regard.) Hmm wonder if that means the current 19500 build is already using that fix, 19000 20H1 hasn't been updated since December and might be vulnerable still. Guess a .xxx update for current 19000 build would also confirm it's kinda probably going to be the RTM build instead of issuing a full new build. And whatever else for 19H2 and earlier this cumulative will fix up.

#5750727

Rich_Guy

2020-01-14 21:14

and were patched! 😀

#5750762

bemaniac

2020-01-14 22:52

whole bunch of new stuff just came down the pipe

#5750770

BetA

2020-01-14 23:51

there you go....

Microsoft Windows CryptoAPI fails to properly validate ECC certificate chains Vulnerability Note VU#849224 Original Release Date: 2020-01-14 | Last Revised: 2020-01-14 Overview The Microsoft Windows CryptoAPI fails to properly validate certificates that use Elliptic Curve Cryptography (ECC), which may allow an attacker to spoof the validity of certificate chains. Description The Microsoft Windows CryptoAPI, which is provided by Crypt32.dll, fails to validate ECC certificates in a way that properly leverages the protections that ECC cryptography should provide. As a result, an attacker may be able to craft a certificate that appears to have the ability to be traced to a trusted root certificate authority. Any software, including third-party non-Microsoft software, that relies on the Windows CertGetCertificateChain() function to determine if an X.509 certificate can be traced to a trusted root CA may incorrectly determine the trustworthiness of a certificate chain. Impact By exploiting this vulnerability, an attacker may be able to spoof a valid X.509 certificate chain on a vulnerable Windows system. This may allow various actions including, but not limited to, interception and modification of TLS-encrypted communications or spoofing an Authenticode signature. Solution Apply an update This vulnerability is addressed in the Microsoft Update for CVE-2020-0601.

Full CERT Report: https://kb.cert.org/vuls/id/849224/ The NSA did found this one.. just on a side note.. (im pretty shure they even used it)

Update, Jan. 14, 9:20 a.m. ET: The NSA’s Neuberger said in a media call this morning that the agency did indeed report this vulnerability to Microsoft, and that this was the first time Microsoft will have credited NSA for reporting a security flaw. Neuberger said NSA researchers discovered the bug in their own research, and that Microsoft’s advisory later today will state that Microsoft has seen no active exploitation of it yet. According to the NSA, the problem exists in Windows 10 and Windows Server 2016. Asked why the NSA was focusing on this particular vulnerability, Neuberger said the concern was that it “makes trust vulnerable.” The agency declined to say when it discovered the flaw, and that it would wait until Microsoft releases a patch for it later today before discussing further details of the vulnerability. Update, 1:47 p.m. ET: Microsoft has released updates for this flaw (CVE-2020-0601). Their advisory is here. The NSA’s writeup (PDF) includes quite a bit more detail, as does the advisory from CERT.

Updated from Krebs https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/ -- This issue was disclosed by Microsoft, who in turn credit the National Security Agency (NSA).