Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

Google Shares PoC Exploit For Critical Windows 10 Graphics RCE Bug

Google Shares PoC Exploit For Critical Windows 10 Graphics RCE Bug

Project Zero, Google’s 0day bug-hunting team, shared technical details and proof-of-concept (PoC) exploit code for a critical remote code execution (RCE) bug affecting a Windows graphics component.

The Project Zero researchers discovered the vulnerability, tracked as CVE-2021-24093, in a high-quality text rendering Windows API named Microsoft DirectWrite.

They reported the bug to the Microsoft Security Response Center in November. The company released security updates to address it on all vulnerable platforms on February 9, during this month’s Patch Tuesday.

Impacts Windows 10 versions up to 20H2

The security flaw impacts multiple Windows 10 and Windows Server releases up to version 20H2, the latest released version.

Also Read: How To Comply With PDPA: A Checklist For Businesses

After the 90-day disclosure deadline, Project Zero published a proof-of-concept exploit code that can be used to reproduce the bug in browsers running on fully-patched Windows 10 1909 systems.

“Attached is the proof-of-concept TrueType font together with an HTML file that embeds it and displays the AE character,” the researchers said.

“It reproduces the crash shown above on a fully updated Windows 10 1909, in all major web browsers. The font itself has been subset to only include the faulty glyph and its dependencies.”

From heap-based buffer overflow to RCE

The DirectWrite API is used as the default font rasterizer by major web browsers such as Chrome, Firefox, and Edge for rendering web font glyphs.

Since these web browsers use the DirectWrite API for font rendering, the security flaw can be leveraged by attackers to trigger a memory corruption state that may allow them to execute arbitrary code on the targets’ systems remotely.

Attackers can exploit CVE-2021-24093 by tricking targets into visiting websites with maliciously crafted TrueType fonts that trigger a heap-based buffer overflow in the fsg_ExecuteGlyph API function.

Google patched a similar actively exploited zero-day in the popular FreeType text rendering library used to target Chrome users.

Also Read: In Case You Didn’t Know, ISO 27001 Requires Penetration Testing

In November, Microsoft also fixed a Windows kernel zero-day bug actively exploited in targeted attacks and publicly disclosed by Project Zero one month earlier.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us