|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
Microsoft Releases Workaround Guidance for MSDT “Follina”; Vulnerability 05/31/2022 11:11 AM EDT Original release date: May 31, 2022 Microsoft has rel
[See the full post at: Zero day in office – but don’t panic]
Susan Bradley Patch Lady/Prudent patcher
Does this help? The List of URI Commands to launch Windows 10 Apps (winaero.com)
Susan Bradley Patch Lady/Prudent patcher
The group policy solution cautions that if used the policy will disable a user’s ability to run .diagcab files. So presumably this would impact those of us that depend on wushowhide.
Does the registry fix have the same side effect?
Does the registry fix have the same side effect?
No.
Just verified wushowhide still works after applying the registry fix.
It is indeed a group policy setting.
Susan Bradley Patch Lady/Prudent patcher
I believe this is correct.
Group Policy:
Computer Configuration\Administrative Templates\System\Troubleshooting and Diagnostics\Scripted Diagnostics\
Troubleshooting: Allow users to access and run Troubleshooting Wizards = Disabled
Registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\
EnableDiagnostics = 0
Sorry, haven’t tried it yet. Standby.
EDIT:
Answer is YES. I get “An error occurred while troubleshooting” and the explanation: “Troubleshooting has been disabled in Group Policy.”
So I assume the Registry entry has the same effect if you don’t use GP.
0patch Pro also just put out their micropatchs for Folina
by Mitja Kolsek, the 0patch Team
…Our Micropatch
It would be by far the simplest for us to just disable msdt.exe by patching it with a TerminateProcess() call. However, that would render Windows diagnostic wizardry inoperable, even for non-Office applications. Another option was to codify Microsoft’s recommendation into a patch, effectively disabling the ms-msdt: URL protocol handler.
But when possible, we want to minimize our impact outside of removing the vulnerability, so we decided to place our patch in sdiagnhost.exe before the RunScript call and check if the user-provided path contains a “$(” sequence – which is necessary for injecting a PowerShell subexpression. If one is detected, we make sure the RunScript call is bypassed while the Diagnostic Tool keeps running…
** Much better solution than Microsoft’s workaround.
Couldn’t the geniuses at Microsoft come with a similar solution ?
This doesn’t help users like me that don’t use Office nor defender.
0Patch fix is more elegant and applies to all Windows users.
Attackers are currently using this in targeted attacks. It’s not widely exploited (yet) at this time.
Susan Bradley Patch Lady/Prudent patcher
Is the patch for this in June updates?
Yes:
On Tuesday June 14, 2022, Microsoft issued Windows updates to address this vulnerability.
Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability
CVE-2022-30190 Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability [See FAQ 2.]
To what extent is this an issue for a standalone PC where the user runs a standard set-up with LibreOffice ?
The hack can happen if you open/preview a Word document in LibreOffice, Windows explorer…
The post was updated on 6/1 to caution about abuse of the search protocol. Is this a different exposure/exploit?
This is a different method to utilize exposure/exploit
A new Windows Search zero-day vulnerability can be used to automatically open a search window containing remotely-hosted malware executables simply by launching a Word document.
The security issue can be leveraged because Windows supports a URI protocol handler called ‘search-ms’ that allows applications and HTML links to launch customized searches on a device.
While most Windows searches will look on the local device’s index, it is also possible to force Windows Search to query file shares on remote hosts and use a custom title for the search window…
To what extent is this an issue for a standalone PC where the user runs a standard set-up with LibreOffice ?
The hack can happen if you open/preview a Word document in LibreOffice, Windows explorer…
0Patch : “it doesn’t matter which version of Office you have installed, or if you have Office installed at all. The vulnerability could also be exploited through other attack vectors. That is why we also patched Windows 7, where the ms-msdt: URL handler is not registered at all“.
Just tested this and, according to the info shown on beeping computer site on how to test this vulnerable, neither each one singularly nor both together actually stop it from happening!
(i.e., search-ms:query=proc&crumb=location:??? still pops up an Explorer window showing the search results.)
First off understand that this is a “get more rights” type of attack that will be more targeted than used in widespread attacks. I would use the ASR rules…
Hi Susan:
I have a Win 10 Pro v21H2 OS and MS Office 2019 Home and Business C2R. Is the method described in your CSO article How to Use Windows Defender Attack Surface Reduction Rules the appropriate way to enable the “Block Office application from creating child processes” rule on my system, namely:
Is there a simpler way to do this with Win 10 Pro (e.g., from Windows Security | App & Browser Control | Exploit Protection | Exploit Protection Settings | System Settings) that I haven’t figured out yet? If not, is creating this this “Block Office application from creating child processes” ASR rule enough to block the MSDT “Follina” vulnerability until Microsoft releases a patch, or is the registry edit in Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability still recommended?
I recall you discussing this Advanced Surface Reduction (ASR) rule several months ago in a previous AskWoody article or newsletter but couldn’t find it today and just happened to stumble across your CSO article during a Google search.
———–
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * MS Office 2019 Home and Business Version 2205 (Build 15225.20204 Click-to-Run)
I recall you discussing this Advanced Surface Reduction (ASR) rule several months ago in a previous AskWoody article or newsletter but couldn’t find it today and just happened to stumble across your CSO article during a Google search.
The same instructions are in ISSUE 18.39 • 2021-10-11 under “Becoming more security-aware“.
So is use the command “reg delete HKEY_CLASSES_ROOT\ms-msdt /f” still the best advice?
FMI, what is the purpose of the “/f ” at the end of the command?
I assume you could also enter the registry and manually delete the key?
No.
The best advice is to install 0Patch fix and retain ms-msdt / troubleshooting.
https://www.askwoody.com/forums/topic/zero-day-in-office-but-dont-panic/#post-2450308
0patch Pro has been turning out micro patch’s daily for follina.
b’s suggestion to use the Microsoft Defender Attack Surface Defender rule “Block Office applications from creating child processes” recommended by Susan for all Office users at October 11, 2021 Issue 18.39 won’t work for me, because as Susan says there, “You must also use Microsoft Defender as your default antivirus, because third-party antivirus solutions disable Defender — which in turn prevents ASR from being used.” I don’t use Defender as my default anti-virus, although at Settings | Update & Security | Windows Security | Virus & threat protection | Microsoft Defender Antivirus options, I have periodic scanning turned on and Microsoft Defender delivers updates to the WU queue periodicially (at least twice, sometimes 3 times a day), after which I download and install them (I have GP-2 download/install). So, I don’t really know if the using the MS Defender Attack Surface Defender rule wil work or not? Anybody want to weigh in on this aspect of using the ASR rule?
Susan included “default” for good reason. Periodic scanning does not suffice for this purpose.
Is this blog alert talking about two separate vulnerabilities that have no relationship to one another
Yes. One is via Word / RTF docs, the other is via search. There are separate workarounds / patches for each.
cheers, Paul
https://askwoodylounge.com/wl/?id=rv75QqPe6PbgY95wqxkUyJLj06t97sva&fmode=download
It won’t impact as it has no file association – but should you want to put it back use that link to put the registry key back into your computer.
It also looks like that:
Susan Bradley Patch Lady/Prudent patcher
Yes, the issue is with Windows, so all Office versions are affected.
Your AV should have updates to catch these documents, but there is a risk that a preview might occur before your AV has scanned the file.
If you don’t open/preview unknown/unexpected documents then you can’t be affected.
cheers, Paul
Any issue where opening a document triggers an infection is bad, m’kay.
MS will patch this and your AV will catch anything that does slip through, so you do not need to worry about being affected.
cheers, Paul
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
