[German]I do not know if it's widely known, but the legitimate Windows application WorkFolders.exe can be used to launch other .exe programs in the Windows System32 folder or the current folder. This allows malware to launch so-called LOLBin attacks, where legitimate operating system files are misused to execute malicious programs. WorkFolders.exe can be abused as a RunDLL substitute.
There is an out-of-bounds vulnerability CVE-2023-34048 in VMware vCenter that leaves systems vulnerable. A security researcher scanned the Internet for accessible and unpatched instances and found numerous systems. Administrators of VMware vCenter installations should ensure systems are patched.
[German]A short info for the colleagues who were still awarded the title "Windows Insider MVP" by Microsoft. December 31, 2023 is finito, the program will be discontinued then. A spokesperson confirmed this to The Register. Microsoft's goal, according to the spokesperson, is to consolidate MVP-like programs at Microsoft. Nice twist, since the Windows Insider MVPs were only kicked out of the "normal MVP program" at the end of 2016.
[German]I'm catching up on a topic that already came to my attention on Mastodon on October 27, 2023. The Public Interest Research Group (PIRG) has set up a petition calling for Microsoft to extend support for Windows 10 beyond 2025. This is to avoid creating a huge mountain of electronic waste because many computers are unsuitable for Windows 11.
[German]Users of the Microsoft Office 365 suite keep reporting that they suddenly get error 1001 when trying to log in. I had already addressed the issue here on the blog. Now Microsoft has confirmed the problem and published a temporary workaround, but wants to investigate the issue further. I summarize the state of affairs, including what has been reported by readers.
[Sponsored Post]In the rapidly evolving IT world, choosing the right remote desktop software is critical for organizations that value security, ease of use and reliability. One provider of secure remote access that has been on the market since 2001 is ISL Online, which presents some considerations for choosing such software below. More ...
[German]Once again, I'm bringing up a topic that has been brought to my attention several times by readers in recent weeks and months. It is about the problem that Microsoft has recently rolled out older versions of drivers for Windows 10 and Windows 11 via Windows Update. This naturally leads to problems on the affected systems. I have collected some cases.
[German]Extremely unpleasant story that threatens users of the new Android 14. Anyone who creates multiple profiles (e.g. professional and private) on a smartphone runs the risk of being locked out by the bug for accessing the device's local memory. Then these users lose the data stored there, as I just read. Fortunately, the suspicion that it was ransomware has not been confirmed. Addendum: Google plans a fix within 2 weeks.
[English]Microsoft updated the Edge browser in the stable channel to version 118.0.2088.76 on October 27, 2023. The release notes here say "fixed various bugs and performance issues". However, it is at the same time a security update of the browser, which according to this page fixes the vulnerability CVE-2023-44323 . The colleagues from deskmodder.de write about two fixed vulnerabilities – but one is Chromium-based.
[German]The US company ServiceNow Inc. offers a cloud platform in whose software there has been a gaping bug since 2015 that allowed third parties to siphon off information without authentication. After a security researcher discovered the vulnerability, it was quietly eliminated in the cloud solution.
[German]Apple has already released iOS 17.1 (also iPadOS) and macOS 14.1 on October 25, 2023. iOS 17.1 probably fixes an Exchange synchronization bug (described here in the blog), as a reader reports. In addition, a bug that reveals the MAC address to iPhones is eliminated. Furthermore, a vulnerability called iLeakage became public the other day. The Safari browser reveals sensitive information such as passwords under iOS and macOS. This vulnerability has not been patched yet.
MVP:
2013 – 2016
WIMVP:
2017 – 2020
