Microsoft Put Off Fixing Zero Day for 2 Years
Summary: Microsoft patched CVE-2020-1464, a Windows digital-signature spoofing flaw, on Aug. 11 among 120 security holes, two years after the weakness was first seen exploited in the wild in August 2018. VirusTotal manager Bernardo Quintero published the flaw on Jan. 15, 2019, writing that Microsoft validated his findings but chose not to fix the issue in current versions of Windows.
Bottom line: Researchers told Microsoft about this flaw over 18 months before it was patched, and a sample uploaded to VirusTotal in August 2018 was still detected as a malicious Java trojan by 28 of 59 antivirus programs when rescanned on Aug. 14, 2020.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2020-1464
- Related
- CVE-2020-1464: Microsoft Windows Spoofing Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, August 2020 Edition Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026