Tuesday’s patch bundle additionally mounted MiniPlasma, a separate vulnerability disclosed by Nightmare Eclipse. Microsoft mentioned in an e mail that the vulnerability is tracked as CVE-2020-17103, a vulnerability Microsoft first mounted six years in the past. Which means MiniPlasma was the results of a regression or an incomplete patch in its preliminary kind. The corporate is within the technique of updating Tuesday’s bulletin to notice the republication.
Microsoft has but to launch patches for different vulnerabilities disclosed by Nightmare Eclipse. The corporate did present guide directions for mitigating YellowKey, a vulnerability that enables attackers to defeat Bitlocker full-disk encryption. That may very well be a boon when attackers have bodily entry to a tool (the exact situation Bitlocker is designed to guard in opposition to). The corporate has but to repair the underlying reason for the vulnerability.
The standing of different vulnerabilities disclosed by Nightmare Eclipse are additionally unclear in the intervening time. The researcher named one vulnerability, current in Home windows Defender RedSun. One other, named BlueHammer, can be a neighborhood privilege escalation flaw that gives SYSTEM rights.
Over the previous few months, Nightmare Eclipse has taken a number of potshots at Microsoft. The precise criticisms stay unclear, however many make references to complaints in regards to the firm’s vulnerability disclosure program. Microsoft, in flip, has publicly railed in opposition to the researcher for “not responsibly” disclosing the vulnerabilities and made a vailed reference to the opportunity of pursuing authorized motion. After a public backlash, Microsoft later relented and vowed no such authorized motion would happen.
On Tuesday, Nightmare Eclipse printed exploit code for a brand new Home windows vulnerability. It’s a race situation that targets Defender.
Tuesday’s patch batch included fixes for roughly 200 vulnerabilities. However the looks that MiniPlasma was mounted, two of them have been additionally confirmed as zero-days.
Put up up to date to incorporate info Microsoft supplied after preliminary publication of this publish.
