Watch out - even Microsoft WordPad could be a Windows security threat now
Microsoft fixed a way to use WordPad to compromise computers
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Microsofthas fixed a flaw that allowed hackers to abuse the iconic WordPad application to steal NTLM hashes - cryptographic formats in which Windows stores user passwords.
The vulnerability is tracked as CVE-2023-36563, a 6.5 severity score flaw described as an information disclosure bug. It’s apparently one of two flaws being abused in the wild right now.
Microsoft fixed the flaw as part of its Patch Tuesday practice - a cumulative security update that this month saw more than 100 flaws get fixed.
Skype for Business
Microsoft says threat actors could abuse the disclosure bug in two ways, either to log in as a Windows user and run a “specially crafted” application or to get the victim to run a piece ofmalwarethemselves. In both scenarios, the end goal is the same - to take control of the affected endpoint.
Those who are unable to apply the fix immediately can apparently apply a workaround, courtesy of Dustin Childs from the Zero Day Initiative. The workaround includes blocking outbound NTLM-over-SMB onWindows 11. “This new feature hasn’t received much attention, but it could significantly hamper NTLM-relay exploits,“The Registercited Childs.
The second vulnerability being abused by threat actors is a privilege escalation flaw found in Skype for Business. Tracked as CVE-2023-41763, it carries a severity score of 5.3 and could lead to information disclosure.
“An attacker could make a specially crafted network call to the target Skype for Business server, which could cause the parsing of an HTTP request made to an arbitrary address,” Microsoft wrote. As a result, a threat actor could obtain information such as IP addresses or port numbers - although the information would be read-only, though.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Among other fixed flaws is Rapid Reset, a vulnerability in HTTP/2 that allowed hackers to mount the largest DDoS attack ever recorded.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Google TV will require more RAM for future upgrades – which might leave older TVs and streaming boxes behind
