Windows 7 and Windows Server 2008 R2 victims of a Zero Day vulnerability for which there is currently no corrective patch

In mid-March we heard about a Zero Day threat that put at risk to computers based on Windows 7 and Windows 10. And especially serious was the case of the first, an operating system that is no longer supported by Microsoft.

Now, around 2021, a Zero Day vulnerability has reappeared that affects computers running Windows 7 and Windows Server 2008 R2. An extremely serious security breach that will force the release of a corrective patch that restores security to that version of Windows, still used on many computers.

Windows 7 in danger again

The vulnerability, discovered incidentally by a French researcher, Clément Labro, resides in two misconfigured registry keys for the RPC Endpoint Mapper and DNSCache servicesthat are part of all Windows installations.

• HKLM \ SYSTEM \ CurrentControlSet \ Services \ RpcEptMapper
• HKLM \ SYSTEM \ CurrentControlSet \ Services \ Dnscache

With this OS breach that we remember, support ended on January 14, 2020, an attacker with access to a foothold on weakened systems, you can modify the affected registry keys and activate a subkey that is normally used by the application performance monitoring mechanism in Windows.

These subkeys allow developers to load their own DLL files and thus track the application. And while these DLLs are currently very limited, in versions like those affected it was still possible to load custom DLLs that were executed with SYSTEM level privileges .

With these data on the table, it remains to wait for Microsoft's response to an atypical case. On the one hand, we find ourselves with an operating system that is no longer supported. Both Windows 7 and Windows Server 2008 R2 do not have security updates and only those Windows 7 users who subscribe to the ESU (Extended Support Updates) program have extra updates, although for now, this security breach has not been patched

Besides.the accidental discovery by the aforementioned researcher and the haste due to the bug found, has made it impossible to follow the usual process in which before announcing the bug publicly, it is communicated to the affected company, in this case Microsoft, to launch the appropriate correction.

In view of this threat, ZDNet has reported that after contacting Microsoft, they have not received any kind of official response in this regard, so we will have to wait to find out if Microsoft finally decides to release a patch that corrects the system. Something that cannot be ruled out seeing how Microsoft has already launched special patches for Windows 7.

While it has been the company ACROS Security, which has created a micropatch that is installed through security software 0patch of the company.

Via | ZDNet