Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
A vulnerability affecting all versions of Windows was publicly released on September 20th [1]. If exploited, this vulnerability could allow an unauthenticated attacker to perform remote code execution on vulnerable systems. The cause of the vulnerability is found in the Microsoft JET Database Engine, which allows threat actors to perform an out-of-bounds write. There is a medium-high confidence rating that threat actors will act to quickly weaponize this vulnerability as Microsoft has not released a security patch and Proof-of-Concept code has been made publicly available [2].
In an attack scenario, a threat actor would send a maliciously crafted file with data stored in the JET database format or add the malicious document to a compromised website. If the attachment is opened the malicious file will execute [3].The Microsoft JET Database Engine can be exploited due to an issue with index management to cause an out-of-bounds write; this is when data is written past the end or before the beginning of the intended buffer. Out-of-bound writes can result in data corruption, software crashes or code execution.
The Jet Database Remote Code Execution vulnerability was publicly disclosed before security patching due to a 120-day notification deadline not being met. The vulnerability was initially reported to Microsoft on May 8th and the development of a security patch is reported as ongoing.
References:
[1] (0Day) Microsoft Windows Jet Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability
https://www.zerodayinitiative.com/advisories/ZDI-18-1075/
[2] ZDI-CAN-6135: A REMOTE CODE EXECUTION VULNERABILITY IN THE MICROSOFT WINDOWS JET DATABASE ENGINE
https://github.com/thezdi/PoC/tree/master/ZDI-18-1075
[3] ZDI-CAN-6135: A REMOTE CODE EXECUTION VULNERABILITY IN THE MICROSOFT WINDOWS JET DATABASE ENGINE
https://www.thezdi.com/blog/2018/9/20/zdi-can-6135-a-remote-code-execution-vulnerability-in-the-microsoft-windows-jet-database-engine