Zero-Day in Windows 10 allows files to be overwritten !

A security researcher has released proof-of-concept code for a zero-day exploit in Windows10 
The bug was revealed by SandboxEscaper, a researcher who has exposed Windows    vulnerabilities in the past
The bug makes it possible to overwrite files with arbitrary data
SandboxEscaper warned Microsoft about the problem on Christmas day, before publishing the PoC a couple of days later
The proof-of-concept showed that it is possible to overwrite the file pci.sys with data collected through Windows Error Reporting. The fact that it is possible to attack a system file such as this shows that an attacker could create a DoS on a target machine from a user account without administrative privileges.
This is confirmed by Will Dormann, a vulnerability analyst at CERT/CC

In response, Mitja Kolsek from 0patch dismissed attempts to downplay the seriousness of the problem

You can find out more about the exploit over on GitHub.

Post a Comment