0Patch Micro patch against Follina vulnerability (CVE-2022-30190) in WindowsBorn's Tech and Windows World

Windows [German]The ACROS Security team around founder Mitja Kolsek has released a micro-patch to close the 0-click Microsoft Diagnostic Tool remote code vulnerability (CVE-2022-30190, Follina). The micro-patch is available for all customers with Windows and the 0patch agent free license. Here is some information about it.

Advertising

Windows Follina vulnerability (CVE-2022-30190)

A new vulnerability CVE-2022-30190 named Follina in Microsoft Support Diagnostic Tool (MSDT) has been known since the weekend, which can be exploited in Windows in combination with Microsoft Office and Powershell. The vulnerability allows remote code execution when MSDT is invoked via the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can execute arbitrary code with the privileges of the calling application. The attacker may then be able to install programs, view, modify or delete data, or create new accounts in the context allowed by the user's privileges.

I had published details in the blog posts Follina vulnerabilitiy (CVE-2022-30190): Status, Findings, Warnings & Attacks and Follina: Attack via Word documents and ms-msdt protocol (CVE-2022-30190). A support document Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability is now available from Microsoft, which also provides guidance on mitigating the vulnerability.

Windows Defender detects attack attempts and blocks them. Nevertheless, there is a risk that the previously unpatched vulnerability will be exploited – only attack attempts have been observed for weeks.

New micro-patch for the vulnerability

After analyzing the vulnerabilities, the team at ACROS Security, which has been providing the 0Patch solution for years, has developed micro-patches for Windows versions that are no longer officially supported and is now making them available to customers. Mitja Kolsek drew attention to this solution via Twitter and sent me a private message regarding it.

Advertising

Details are described in this 0patch blog post from June 1, 2022. Mitja Kolsek and his team have found a way to block attacks via msdt.exe, regardless of how msdt.exe was started, via micro-patch.

(Source: YouTube)

The video shows how the micro-patch works. Since this is a 0-day vulnerability for which no official vendor patch is available, the developers at ACROS Securiy are making the micro-patch available for free via the Free 0Patch agent until such a fix becomes available. The micro-patches were written for:

Windows 11 v21H2
Windows 10 v21H2
Windows 10 v21H1
Windows 10 v20H2
Windows 10 v2004
Windows 10 v1909
Windows 10 v1903
Windows 10 v1809
Windows 10 v1803
Windows 7
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
Windows Server 2019
Windows Server 2022

Notes on how the 0patch agent, which loads micropatches into memory at an application's runtime, works can be found in blog posts (such as here).

Advertising

One Response to 0Patch Micro patch against Follina vulnerability (CVE-2022-30190) in Windows

Robert-Jan says:

2022-06-03 at 15:33

You can also use the command below to add a registry key that blocks MSDT

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics" /t REG_DWORD /v EnableDiagnostics /d 0 /f

0Patch Micro patch against Follina vulnerability (CVE-2022-30190) in Windows

Windows Follina vulnerability (CVE-2022-30190)

New micro-patch for the vulnerability

One Response to 0Patch Micro patch against Follina vulnerability (CVE-2022-30190) in Windows

Leave a Reply Cancel reply

Blogs

Links

Social networks

Awards

Sponsors

Recent Comments

Recent Comments

Meta