Google Unveils Unpatched and Poorly Fixed Windows 0-Day Vulnerability

Dec 24, 2020

Google’s Project Zero team has disclosed details about a poorly addressed zero-day security flaw in the Windows print spooler API, potentially allowing malicious actors to execute arbitrary code. The flaw was made public after Microsoft failed to resolve it within 90 days of responsible disclosure on September 24. Initially identified as CVE-2020-0986, the vulnerability involves an elevation of privilege exploit in the GDI Print / Print Spooler API (“splwow64.exe”) reported to Microsoft by an anonymous user collaborating with Trend Micro’s Zero Day Initiative (ZDI) in late December 2019. With no patch provided for nearly six months, ZDI publicly issued a zero-day advisory on May 19, which led to exploitation in a campaign known as “Operation PowerFall” targeting an unnamed South Korean company. “splwow64.exe” is a core Windows system binary that facilitates 32-bit application compatibility.

Google Exposes Unpatched Windows Zero-Day Vulnerability

On December 24, 2020, Google’s Project Zero disclosed details about a critical yet poorly patched zero-day vulnerability within the Windows print spooler API. This flaw opens the door for malicious actors to execute arbitrary code, creating significant risks for affected systems. The decision to make this information public follows Microsoft’s inability to implement a fix within the 90-day window provided after the initial responsible disclosure on September 24.

The vulnerability, identified as CVE-2020-0986, relates specifically to privilege escalation within the GDI Print / Print Spooler API, particularly the “splwow64.exe” process. Initially reported to the tech giant by an anonymous source collaborating with Trend Micro’s Zero Day Initiative in late December 2019, the urgency for a patch was evident. However, with no remedy forthcoming after six months, the Zero Day Initiative chose to issue a public advisory on May 19, which categorized the flaw as a zero-day.

The implications of this unaddressed security gap were soon evident, as it became part of the operational arsenal in a cyber attack campaign known as “Operation PowerFall.” This incident targeted an unnamed entity based in South Korea, showcasing the potential for widespread exploitation of the vulnerability in the absence of timely mitigation.

“Splwow64.exe,” a core Windows system binary that facilitates the interaction between 32-bit and 64-bit processes, plays a pivotal role in print services. Its compromise could allow attackers to escalate their privileges significantly, potentially gaining control over infected systems.

The tactics associated with this vulnerability align closely with the MITRE ATT&CK framework, where techniques such as initial access, privilege escalation, and execution come into play. Attackers likely exploited the privilege elevation aspect of the vulnerability to gain unauthorized access to sensitive resources. With the increasing threat landscape, this incident underscores the critical need for organizations to prioritize timely patch management and vulnerability assessments.

As the cybersecurity community continues to grapple with the ramifications of this zero-day, businesses are reminded of the vital importance of maintaining robust security hygiene. An unpatched vulnerability such as CVE-2020-0986 could serve not only as a vector for exploitation but also as a stark reminder of the risks associated with delayed patch implementation.

In conclusion, as vulnerabilities like this emerge, a proactive approach to cybersecurity will be essential for organizations looking to safeguard their digital infrastructures against increasingly sophisticated threats.

Source link