{"uuid": "85daf0e9-9ba9-4f73-8b75-f6393133b2eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/hacking_Attack/8310", "content": "Black Hat Ethical Hacking\nWormable Windows Bug Opens Door to DoS, RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89 \nReading Time: 2 Minutes\nMicrosoft\u2019s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a\u00a0patch for a concerning wormable vulnerability found in the Windows OS.\nThe good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes\u00a0address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated \u201cimportant\u201d and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month\u2019s Patch Tuesday release are:\n\n* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)\n* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE\n* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation\n* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 \u2013 WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).\n\n\u201cIf exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,\u201d Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.\nSee Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.\n\n\u201cThe vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,\u201d Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. \u201cWhile this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.\u201d\n\n\u201cFor ransomware operators, this kind of vulnerability is a prime target for exploitation,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cWormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it\u2019s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.\u201d\n\nDustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative (ZDI), noted in a blog, \u201cBefore you pass this aside, Windows 10 can also be configured as a web server, so it [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:43.612112Z"}