Microsoft's software updates for this month have silently addressed the ShadowCoerce security flaw, which could be exploited by threat actors to facilitate NTLM relay attacks that eventually prompt Windows domain takeovers, BleepingComputer reports.
The "MS-FSRVP coercion abuse PoC aka 'ShadowCoerce' was mitigated with CVE-2022-30154, which affected the same component," said a Microsoft spokesperson.
Patches for ShadowCoerce, which has yet to be given a CVE ID, were earlier reported by ACROS Security CEO Mitja Kolsek. However, cybersecurity experts urged Microsoft to be more transparent about the inclusion of fixes in their updates.
"It would be nice if MS were more open about this. I find unbelievable that in many ways MS is more secretive about security now than in the "bad old days" unless they can throw a marketing spin on it. Material security changes should be clearly documented in security bulletins," said Google Project Zero security researcher James Forshaw in a tweet.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.