Potential Elevation of Privilege Vulnerability in Windows Backup

Summary

The first article outlines a potential elevation of privilege vulnerability in Windows Backup, which could allow an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or bypass some features of Virtualization Based Security (VBS). Exploitation requires interaction by a privileged user, and Microsoft is currently working on a security update to mitigate the threat. There are no known attempts to exploit this vulnerability, but a public presentation of the vulnerability was hosted at BlackHat, and attendees are encouraged to follow Recommended Actions to protect their systems. The second article reveals that SafeBreach security researcher Alon Leviev discovered two zero-day vulnerabilities in Windows Update, which could be exploited in downgrade attacks to "unpatch" fully updated Windows 10, 11, and Server systems and reintroduce old vulnerabilities. These vulnerabilities have not yet received a security update from Microsoft, even though six months have passed since they were reported. The exploitation of these zero-day vulnerabilities could expose systems to thousands of past vulnerabilities and make the term "fully patched" meaningless on any Windows machine. There are observed attempts to exploit these vulnerabilities, making it crucial for users to upgrade to the fixed version as soon as it becomes available.

News Articles

The Hacker News

CVE-2024-21302CVE-2024-38202

Researchers Uncover OS Downgrade Vulnerability Targeting Microsoft Windows Kernel

Discover how a new attack technique bypasses Microsoft’s security, enabling OS downgrade attacks on Windows.

1 month ago

BleepingComputer

CVE-2024-38202CVE-2024-21302

Windows Downdate tool lets you 'unpatch' Windows systems

SafeBreach security researcher Alon Leviev has released his Windows Downdate tool, which can be used for downgrade attacks that reintroduce old vulnerabilities in up-to-date Windows 10, Windows 11, and Windows Server systems.

3 months ago

eSecurity Planet

CVE-2024-38202CVE-2024-7593

Vulnerability Recap 8/19/24: Microsoft, Ivanti, SolarWinds

Microsoft appears on our list multiple times this week, with notable Patch Tuesday CVEs and an Entra ID vulnerability that affects hybrid clouds.

3 months ago

More News...