Windows: 0Patch Micropatch for MOTOW ZIP file bug (0-day, no CVE)Born's Tech and Windows World

Sicherheit (Pexels, allgemeine Nutzung) [German]Since May 2022, a bug has been known to exist in Windows that prevents the "Mark of the Web" flag from being set for files extracted from ZIP archives. Microsoft itself has not yet released a patch for this 0-day vulnerability. The vulnerability is already being exploited. Therefore, ACROS Security has addressed the problem and developed a 0Patch micropatch to close it. The patch is freely available, only the 0patch agent is needed.

Advertising

Mitja Kolsek, the founder of ACROS Security informed me about this micropatch in a personal message a few hours ago, but also made the issue public in the following tweet as well as the details in this blog post.

What is MOTW about?

Windows can display a security warning before opening and launching an executable file downloaded from the Internet. This "Smart App Control" only works with files that have the Mark of the Web (MOTW) flag set. Smart App Control is intended to provide better protection against new and emerging threats in Windows 11 by blocking malicious or untrusted apps. Smart App Control also helps block potentially unwanted apps. These are apps that can cause your device to run slowly, display unexpected ads, offer additional software that is not wanted by the user. Microsoft Office also blocks macros in documents with MOTW (source).

Bug prevents Windows set the MOTW flag

Attackers therefore try to avoid marking their malicious files with MOTW. A bug in Windows allows attackers to create a ZIP archive in such a way that extracted malicious files are not marked with MOTW. Security researcher Will Dormann discovered a vulnerability in Windows in May 2022.

Advertising

This vulnerability allows an attacker to prevent Windows from setting the "Mark of the Web" mark for files extracted from a ZIP archive. This is true even if the ZIP archive comes from an untrusted source such as the Internet, an email, or a USB stick. This renders Microsoft's nice security solutions ineffective.

Will informed Microsoft about this problem in July, but an official solution has not been provided yet. In the meantime, the vulnerability is apparently being exploited in the wild. So far, however, there is no patch and not even a CVE identifier for it.

The 0Patch solution

ACROS Security has analyzed the vulnerability and released micropatches for it. These are available for free via the 0patch agent until Microsoft has released the official fix. Details on how it works can be found out in this blog post and the embedded video.

Notes on how the 0patch agent works, which loads the micropatches into memory at an application's runtime, can be found in blog posts (such as here).

Advertising

Windows: 0Patch Micropatch for MOTOW ZIP file bug (0-day, no CVE)

What is MOTW about?

Bug prevents Windows set the MOTW flag

The 0Patch solution

Leave a Reply Cancel reply

Blogs

Links

Social networks

Awards

Sponsors

Recent Comments

Recent Comments

Meta