Security experts at Google discovered vulnerability ‘Crazy Bad’ in Microsoft Windows, which Microsoft fixed quickly through a Windows update.
The experts at Google’s Security found an unpatched vulnerability in the Windows OS and it seemed to be truly a dangerous one.
Worst Vulnerability
According to Tavis Ormandy along with Natalie Silvanovich, the researchers at Google’s Project Zero, they noticed one of the worst types of RCE in Microsoft Windows OS. However, they did not offer any other details regarding the vulnerability, due to obvious reasons of security. Tavis Ormandy stated on the 6th of May that he and Natalie Silvanovich had found one of the worst RCE or remote code exec in Windows OS in recent times and described it as crazy bad. The attack, according to him, worked against default installations, without being on a single LAN and it was wormable.
Time Allowed
Microsoft was allowed a time of one week for responding to the vulnerability discovered. If no security update were released within three months, the researchers would publish the issue with details online, according to the Google Project Zero’s policy.
Microsoft Fix
However, Microsoft offered to fix the security flaw in a very short span of time using a security patch for Windows Update that is now in the process of being shipped. Moreover, Microsoft has also offered information regarding the security vulnerability, stating that the flaw was in the protection engine for anti malware, in the Windows 7 and in Windows 8.1, RT and also in Windows 10.
Microsoft has explained that if the attacked system has real time protection activated on it, the exploit is immediately triggered when the infected file or files are scanned. However, if the real time protection is switched off, the attacker will have to wait for the victim to scan the file manually.
The Vulnerabilities
The REC flaw could allow attackers to get control of systems by the use of malicious codes in emails, instant messages and through websites created by them. What is worse is that the attacker would be able to take advantage of the vulnerability even if the user has not read the email or opened the attachment. This is why the security experts at Google’s Project Zero described the flaw as a critical RCE one in Windows OS.
Updating your System
Microsoft has recommended to users that they must update the system as quickly as possible with the security patch version 1.1.13704.0. In order to check out their version of the Windows OS, users can open the Settings application and move to Update and Security and then Windows Defender to search for the Engine version.
About the Update
Microsoft has stated that the said update will address the vulnerability that allows RCE when the Protection Engine scans a specifically crafted file. The attacker can then use an arbitrary code in the LocalSystem account and control the victim’s system.
To get this update now, users can head to Settings, Update and Security and Windows Update to check for updates. They do not need to reboot the system, but must keep away from any content coming from an unknown source and also disable the real time protection for the present.