![\"\"](\"https:\/\/sitesdev.net\/articles\/wp-content\/uploads\/2019\/01\/vcard-resized.jpg\")
There’s a new zero-day vulnerability in Windows 10 you need to be aware of.\u00a0 As with all zero-day threats, this one is dangerous in the extreme, allowing a hacker to potentially execute code on your machine remotely.<\/p>\nThere’s a new zero-day vulnerability in Windows 10 you need to be aware of.\u00a0 As with all zero-day threats, this one is dangerous in the extreme, allowing a hacker to potentially execute code on your machine remotely.<\/p>\n
It was discovered by security researcher John Page, and reported to the company via Trend Micro’s Zero-Day Initiative more than six months ago.<\/p>\n
To date, the company has refused to patch their software in response.\u00a0 In fact, the issue hasn’t even received a CVE number yet.<\/p>\n
The issue resides within the processing of a vCard file, which is a standard file format used by Microsoft Outlook to store contact information. Each vCard has space for the contact’s website.\u00a0 Unfortunately, a hacker can plug in whatever value they like there, including a web address pointing to a file that can be downloaded and remotely executed on the target machine.\u00a0 All it takes is for the victim to click on the link in the poisoned vCard.<\/p>\n
Page has published a proof of concept for the exploit, which has been assigned a CVSS 23.0 score of 7.8.\u00a0 It would have been even higher than that, but in order to be successful, the exploit does require action on the user’s part (the link in the vCard actually has to be clicked).<\/p>\n
Even considering this, it seems strange that Microsoft wouldn’t take steps to fix the issue, or at least to assign it a CVE number.\u00a0 Leaving this exploit un-patched opens the door to abuse.\u00a0 It’s like hanging a neon sign above every installation of Microsoft Outlook, begging hackers to take advantage of it.<\/p>\n
To this point, we know of no instances of this attack being used in the wild, but it’s just a matter of time.\u00a0 Our hope is that Microsoft will take steps to address the problem sooner, rather than later.<\/p>\n
\u00a0<\/p>\n
\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
There’s a new zero-day vulnerability in Windows 10 you need to be aware of.\u00a0 As with all zero-day threats, this one is dangerous in the extreme, allowing a hacker to potentially execute code on your machine remotely. It was discovered by security researcher John Page, and reported to the company via Trend Micro’s Zero-Day Initiative […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"yoast_head":"\n