mikiem2
Moderator
krebsonsecurity[.]com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/
Install today's update ASAP once it's released [1:00 pm Eastern]. Allegedly the NSA found a serious flaw in a core part of Windows security, and the fix is due out today.
According to the NSA Microsoft has not seen the bug exploited in the wild, but expect that to change once details of the flaw & its patch are disclosed later today.
mikiem2
Moderator
The patch is out, and the update's page at microsoft[.]com says very little. Krebs On Security has updated his page to include 3 links for more info:
portal.msrc.microsoft[.]com/en-US/security-guidance/advisory/CVE-2020-0601
media.defense[.]gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF
kb.cert[.]org/vuls/id/849224/
While Krebs said: "This component was introduced into Windows more than 20 years ago — back in Windows NT 4.0. Consequently, all versions of Windows are likely affected (including Windows XP, which is no longer being supported with patches from Microsoft).", info at those 3 links only talks about Windows 10 & Server 2016/2019.
Whiterabbit-uk
Games Guru
Thanks Mikiem.
I've locked the comment you made over in the game discussion forums to the top of the comments; though as my comment is also locked to the top, you's will appear below my comment. I've also made a note at the top of my comment for the community to read your comment.
mikiem2
Moderator
Thanks for that.
There were enough warnings on tech sites, plus Will Dormann's tweets, that I'm sure this did not escape very many actual & aspiring cybercriminals. I imagine that seeing that, some started looking for flaws even before the patch & details were released. Attackers will normally try to exploit Windows vulnerabilities once details of the monthly patch updates are released, hoping to snare those who didn't install the updates, but because of all the attention they might especially target this one.
You must log in to post.