A security researcher has publicly disclosed a 0Day that affects all supported versions of Microsoft's operating system.
The Windows vulnerability, which also affects server versions, was publicly disclosed when the company failed to patch the bug within 120 days.
The 0Day was discovered by Lucas Leong of Trend Micro Security Research, and is located in Microsoft Jet's Jet Database Engine. The vulnerability could allow an attacker to remotely run malicious code on any vulnerable Windows computer.
Microsoft's Jet Database Engine, or simply JET (for Joint Engine Technology), is a database engine that is integrated into many Microsoft products, such as Microsoft Access and Visual Basic.
According to the announcement issued by the Zero Day Initiative (ZDI), the vulnerability is due to an issue with index management in the Jet Database Engine that, if successfully exploited, could cause out-bounds memory writes and remote code execution.
An attacker would have to convince the target to open a specially crafted JET database file to exploit the vulnerability and remotely execute malicious code on the target computer.
According to ZDI researchers, the vulnerability exists in all supported versions of Windows, namely: Windows 10, Windows 8.1, Windows 7 and Windows Server Edition 2008 to 2016.
ZDI reported the vulnerability to Microsoft on May 8 and the company confirmed the bug on May 14, but failed to fix the vulnerability and release an update within the 120-day deadline. Thus, ZDI publicly released the details of the vulnerability.
It was also published by Trend Micro on a GitHub page.
Microsoft is reportedly developing a fix for the vulnerability and since it was not included in the September Patch Tuesday, we will probably see it in the October updates.
Trend Micro recommends that Windows users do not open files from untrusted sources.
______________________
- DaaS or device-as-a-service Microsoft coming soon to you
- When will Windows 10 Redstone 5 RTM be released?
- Microsoft GitHub: the past is the biggest challenge
- The free version of Microsoft Teams is now available
- Windows 10 April: lost your desktop?
- Windows 10 Build 17738 download official ISOs
- Windows 10 and Windows 7: What the numbers say
