News

Google Researcher Publishes Unpatched Windows 8.1 Security Vulnerability

Usually, found security exploits are reported before publicised and so was MSRC-20544 exploit for Windows 8.1. But 90 days after the security researcher from Google had reported the flaw to Microsoft, it still wasn’t patched and he instead chose to release the information to the public in order to pressure Microsoft to act and fix the flaw.

Besides just disclosing the flaw, he also shows how to use it and according to feedback it works. The vulnerability allows for an elevation of privilege in ahcache.sys/NtApphelpCacheControl and the blog post also provides a demo application that can launch calc.exe using the exploit. It was only tested on Windows 8.1 and it is not known if prior versions of Windows are affected as well.

Microsoft issued the following response to the vulnerability:

“We are working to release a security update to address an Elevation of Privilege issue. It is important to note that for a would-be attacker to potentially exploit a system, they would first need to have valid logon credentials and be able to log on locally to a targeted machine. We encourage customers to keep their anti-virus software up to date, install all available Security Updates and enable the firewall on their computer.”

So there is a mixture of good and bad news in this exploit. Someone needs to have direct access to your system in order to exploit it and a patch is being worked on. If you’d like to test it on your own system, follow the source link to Google Security where you can find the demo app.

Thanks to Google Security via Neowin for providing us with this information

Bohs Hansen

Disqus Comments Loading...

Recent Posts

Still Wakes the Deep 

LIVE THE HORROR: An immersive disaster story aboard a stunningly realised North Sea oil rig,…

2 hours ago

PHILIPS 275V8LA – 27 Inch QHD Monitor

The Philips VA LED display uses an advanced multi-domain vertical alignment technology that gives you…

2 hours ago

EPOMAKER Ajazz AK820 Pro 75% Gasket-mounted Mechanical Keyboard 

【TFT Screen: The Interactive Interface】This 75% mechanical keyboard comes equipped with a TFT Screen, serving…

2 hours ago

Funko Fusion

FANDOM FUSION Play as your favorite characters and wield their unique weapons and skills. Team…

2 hours ago

Shin Megami Tensei V: Vengeance Standard Edition

The Definitive Version of Shin Megami Tensei V - Fully evolved with stunning visuals for…

2 hours ago

Hand Warmers Rechargeable 2 Pack

【Unique Split Design】5200mAh hand warmers rechargeable together with double-sided heating function, split snap swivel design,…

2 hours ago