Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed

Tuesday’s patch bundle additionally fastened MiniPlasma, a separate vulnerability disclosed by Nightmare Eclipse. Microsoft mentioned in an e mail that the vulnerability is tracked as CVE-2020-17103, a vulnerability Microsoft first fastened six years in the past. Which means MiniPlasma was the results of a regression or an incomplete patch in its preliminary type. The corporate is within the technique of updating Tuesday’s bulletin to notice the republication.

Microsoft has but to launch patches for different vulnerabilities disclosed by Nightmare Eclipse. The corporate did present guide directions for mitigating YellowKey, a vulnerability that permits attackers to defeat Bitlocker full-disk encryption. That may very well be a boon when attackers have bodily entry to a tool (the exact state of affairs Bitlocker is designed to guard in opposition to). The corporate has but to repair the underlying explanation for the vulnerability.

The standing of different vulnerabilities disclosed by Nightmare Eclipse are additionally unclear in the intervening time. The researcher named one vulnerability, current in Home windows Defender RedSun. One other, named BlueHammer, can also be a neighborhood privilege escalation flaw that gives SYSTEM rights.

Over the previous few months, Nightmare Eclipse has taken a number of potshots at Microsoft. The precise criticisms stay unclear, however many make references to complaints concerning the firm’s vulnerability disclosure program. Microsoft, in flip, has publicly railed in opposition to the researcher for “not responsibly” disclosing the vulnerabilities and made a vailed reference to the potential of pursuing authorized motion. After a public backlash, Microsoft later relented and vowed no such authorized motion would happen.

On Tuesday, Nightmare Eclipse printed exploit code for a brand new Home windows vulnerability. It’s a race situation that targets Defender.

Tuesday’s patch batch included fixes for roughly 200 vulnerabilities. However the looks that MiniPlasma was fastened, two of them have been additionally confirmed as zero-days.

Put up up to date to incorporate data Microsoft offered after preliminary publication of this put up.