Google publishes third Windows 0-day vulnerability in a month
Lucian Constantin By Lucian Constantin
IDG News Service | Jan 16, 2015 4:10 AM PT
Google ignored Microsoft’s calls for flexible vulnerability disclosure
deadlines and released details of another unpatched Windows flaw, leaving
users exposed for at least the next 25 days.
FEATURED RESOURCE
PRESENTED BY JIVE SOFTWARE
10 Commandments of Collaboration for Exceptional Customer Service
Read this whitepaper to discover best practices that drive brand affinity,
repeat business and
LEARN MORE
The new vulnerability, which was confirmed on Windows 7 and 8.1, might
constitute a security feature bypass for the way applications can encrypt
their memory so that data can be exchanged between processes running under
the same logon session.
“The issue is the implementation in CNG.sys doesn’t check the
impersonation level of the token when capturing the logon session id (using
SeQueryAuthenticationIdToken) so a normal user can impersonate at
Identification level and decrypt or encrypt data for that logon session,”
the Google Project Zero researchers said in a description of the flaw. “
This might be an issue if there’s a service which is vulnerable to a named
pipe planting attack or is storing encrypted data in a world readable shared
memory section.”
MORE ON NETWORK WORLD: 26 crazy and scary things the TSA has found on
travelers
According to Project Zero, Microsoft was notified of the vulnerability on
Oct. 17 and initially planned to fix it during its January Patch Tuesday,
three days ago. However, the fix had to be postponed because of
compatibility issues.
The Google researchers were unmoved by this and stuck to their 90-day public
disclosure deadline, publishing details of the flaw and a proof-of-concept
exploit Thursday.
The fix is now expected to be among Microsoft’s scheduled security updates
on Feb. 10, although there’s no guarantee that it won’t be further delayed
. Of course, Microsoft has the option to release an out-of-band patch at any
time, but the company rarely does this and when it does, it’s typically
for critical flaws that attackers are actively exploiting.
This is the third unpatched Windows vulnerability that Project Zero
researchers have publicly disclosed over the past month because Microsoft
could not issue fixes before the 90-day disclosure deadline enforced by
Google.
On Sunday, Microsoft publicly denounced Google’s inflexibility with
vulnerability disclosure, arguing that researchers should work with affected
companies until a fix is produced before going public.
“We believe those who fully disclose a vulnerability before a fix is
broadly available are doing a disservice to millions of people and the
systems they depend upon,” Chris Betz, senior director with Microsoft’s
Security Response Center, said in a blog post at the time.
However, other researchers feel that 90 days is more than enough for a
software vendor, especially one the size of Microsoft, to fix a
vulnerability.
Microsoft is just “whining” over its own inability to respond to bugs in a
timely manner after over a decade of using its dominant position to dictate
how vulnerabilities should be handled, said Robert Graham, the CTO of
security research firm Errata Security in a blog post Monday. “It’s now
Google who sets the industry’s standard for reporting vulnerabilities,” he
said.