From Forbes: A security researcher who is part of Google's "Project Zero" team tasked with hunting down zero-day vulnerabilities, has gone public with an exploitable Windows vulnerability that Microsoft is still in the process of fixing.
Tavis Ormandy has tweeted that he had uncovered a security issue with the core cryptographic library for Windows, revealing that, "Microsoft committed to fixing it in 90 days, then didn't." As a result of not meeting the Project Zero deadline to fix such issues, which is partly designed to encourage more resources to be applied to software security, Ormandy went on to state, "Today is day 91, so the issue is now public."
It's actually a bug within SymCrypt, the core cryptographic library responsible for implementing asymmetric crypto algorithms in Windows 10 and symmetric crypto algorithms in Windows 8. What Ormandy found was that by using a malformed digital certificate he could force the SymCrypt calculations into an infinite loop. This will effectively perform a denial-of-service (DoS) attack on Windows servers such as those running the IPsec protocols that are required when using a VPN or the Microsoft Exchange Server for email and calendaring for example.
View: Article @ Source Site
