Microsoft has patched vulnerabilities to create worms on Windows 7, Windows 8 and Windows 10. The publisher has also corrected a 20-year-old loophole to elevate privileges.
Yesterday, on the occasion of its Patch Tuesday, Microsoft released patches to be installed urgently, if it is not already done. Indeed, they clog a series of ultra-critical flaws, particularly affecting the latest versions of the operating system. Two flaws similar to "BlueKeep" have been found by Microsoft security researchers (CVE-2019-1181 and CVE-2019-1182).
As a reminder, BlueKeep is a vulnerability in Remote Remote Protocol Protocol (RDP). Detected last May, it allows to create worms for old systems such as Windows XP and Windows 7. It has a potential destructive equivalent to WannaCry or NotPetya.
Three versions of Windows concerned
This is also the case of the two new flaws, which also make it possible to create computer worms. But in their case, it's even worse because they affect the latest versions of the operating system, namely Windows 7, Windows 8 and Windows 10.
At present, it is difficult to know how many computers are affected by these new vulnerabilities. Some experts believe that it's more than for BlueKeep. At the end of last July, more than 788 000 Windows computers were still vulnerable to this first flaw (source: BitSight).
Hack Windows from Notepad
Patch Tuesday also plugs a flaw (CVE-2019-1162) that resides in all Windows systems for more than 20 years. It was found by Tavis Ormandy, a security researcher at Google Project Zero, and provides system privileges from any application.
The problem lies in CTextFramework, a library that handles text input and keyboard layout. This software, which dates from the Windows XP era, is actually riddled with flaws.
As an example, the researcher has successfully launched a command prompt with system privileges since ... Notepad.
