Category: Microsoft|Jan 15, 2022 | Author: Admin

Microsoft refuses to correct the error - took matters into its own hands

• microsoft
• windows
• update
• permalink

Share on

 Facebook |  Twitter |  LinkedIn |  Reddit

Neowin reports that the 0-Day error dubbed "RemotePotato0" has now been fixed, but that Microsoft is not behind it. They refuse to close the security hole, which has resulted in someone releasing an unofficial fix.

Was warned in April

The hole is a so-called "0-Day" error that the company has acknowledged but has not received any attention from them beyond this, so it has not received as much as a CVE ID that is normal for such errors. It was only SentinelOne researchers who discovered the error, which they quickly reported to Microsoft in April 2021.

 

The founder of 0patch, Mitja Kolsek, has on her blog described the problem in addition to sharing an unofficial fix that closes the hole. The entire post can be read here.

 

 

Provides administrator privileges

The way "RemotePotato0" works is that it allows unauthorized people to send out authenticated RPC / DCOM commands.

 

When these are fulfilled, they get more privileges on the domain that is the target of the attack, so they get administrator rights. The hole is described as particularly dangerous as it does not require interaction from the target.

 

Outdated authentication protocols in Windows NT LAN Manager (NTLM) are exploited and make this a vulnerability. Being outdated is probably also why Microsoft does not pay attention to it - they only recommend disabling NTLM or configuring Windows servers to block NTLM-related attacks.

Comments: