Another zero-day security hole in Windows 10 has been made public, by the same security researcher who highlighted a very similar vulnerability back in August.
SandboxEscaper tweeted about the bug (and released a proof of concept), noting that it was difficult to exploit, but still unpatched. The vulnerability affects all flavors of Windows 10 – including the latest October 2018 Update, for those who have installed it – along with Windows Server 2016 and 2019.
https://t.co/1Of8EsOW8z Here's a low quality bug that is a pain to exploit.. still unpatched. I'm done with all this anyway. Probably going to get into problems because of being broke now.. but whatever.October 23, 2018
The problem leverages Microsoft’s Data Sharing Service (dssvc.dll), which facilitates data brokering between running applications.
As ZDNet reports, Will Dormann of CERT/CC noted that it apparently doesn’t affect Windows 8.1 or earlier incarnations of Microsoft’s desktop OS, simply because the aforementioned Data Sharing Service isn’t present in those versions of Windows.
Familiar flaw?
The zero-day vulnerability is described as close to identical to the flaw discovered by SandboxEscaper back in August, as mentioned, although the security researcher took pains to clarify that it certainly isn’t the same bug.
SandboxEscaper observed: “Not the same bug I posted a while back, this doesn't write garbage to files but actually deletes them… meaning you can delete application dll's and hope they go look for them in user write-able locations. Or delete stuff used by system services c:\windows\temp and hijack them.”
In short, the exploit could potentially be used to elevate privileges on a system the attacker already has access to, and facilitate non-admins deleting any file on a computer because the Data Sharing Service isn’t correctly checking permissions (as security expert Kevin Beaumont made clear).
SandboxEscaper’s previous bug revelation employed some colorful language, and had a serious pop at Microsoft’s bug submission procedures, something which the security researcher apparently later regretted.
- Some of our best laptops run Windows 10
