Microsoft JET vulnerability still open to attacks, despite recent patch

A vulnerability in the Microsoft JET database engine is still open to attacks, even after Microsoft shipped an update earlier this week during the October 2018 Patch Tuesday.

More security news

The vulnerability came to light in mid-September after the Trend Micro Zero-Day Initiative (ZDI) posted details about it on its site. ZDI said Microsoft had failed to patch the flaw in due time and they decided to make the issue public, so users and companies could take actions to protect themselves against any exploitation attempts. The vulnerability, which was a zero-day at the time of its disclosure, raised some alarms, mainly due to the fact that the JET database engine is included in all versions of Windows, and provided attackers with a huge attack vector they could target.

The JET engine was one of Microsoft’s first forays in database technologies. It was developed in the 90s and has been used to power various Microsoft apps, with the most recognizable names being Access, Visual Basic, Microsoft Project, and IIS 3.0. JET has been deprecated and replaced by newer technologies in the meantime, but it is still included with Windows for legacy purpose.

Information security experts criticized Microsoft for failing to patch the vulnerability, mainly because it allowed a remote full compromise of the user’s system.

They also remembered that Microsoft was also late to patch a flaw in another legacy product last year –Office’s legacy Equation Editor app– which became one of the most heavily exploited vulnerabilities in the past year. Fortunately, Microsoft did see the problem with leaving the JET zero-day unpatched in the end and shipped an update this past Tuesday. But according to Mitja Kolsek, co-founder of 0patch, Microsoft’s recent JET patch is incomplete, and an attacker can still exploit the original vulnerability.

“At this point we will only state that we found the official fix to be slightly different to our micropatch, and unfortunately in a way that only limited the vulnerability instead of eliminating it,” Kolsek said. “We promptly notified Microsoft about it and will not reveal further details or proof-of-concept until they issue a correct fix.”

0Patch, who released a so-called custom “micro-patch” for the JET zero-day when it came out, released another micro-patch today until Microsoft corrects its original JET fix.

The good news is that until now, neither Microsoft nor 0Patch have seen hackers trying to exploit this vulnerability.

Furthermore, to exploit the vulnerability, a user must open/import a specially crafted Microsoft JET Database Engine file, meaning attacks can’t be automated at scale, and social engineering is still required to trick the user into opening a malicious file.

RELATED COVERAGE:

Peppa Pig Air Peppa Jet FigureTake off in Peppa&39;s free-wheeling Jet with Miss Rabbit! Includes articulated Peppa figure and 1 suitcase Open up the doors lower the stairs then open the baggage hold and load the suitcases! Flip-over Miss Rabbit figure to make space for Peppa to fly the plane There&39;s room for Peppa and her friends inside!For ages 3 years and over Free-wheeling Jet with open up cockpit Includes articulated Peppa figure Flip-over Miss Rabbit pilot or a seat for Peppa to fly the jet!Open the doors & lower the stairs Load the suitacase in the baggage compartment - More Info - EAN: 5029736062279

Peppa Pig Air Peppa Jet FigureTake off in Peppa&39;s free-wheeling Jet with Miss Rabbit! Includes articulated Peppa figure and 1 suitcase Open up the doors lower the stairs then open the baggage hold and load the suitcases! Flip-over Miss Rabbit figure to make space for Peppa to fly the plane There&39;s room for Peppa and her friends inside!For ages 3 years and over Free-wheeling Jet with open up cockpit Includes articulated Peppa figure Flip-over Miss Rabbit pilot or a seat for Peppa to fly the jet!Open the doors & lower the stairs Load the suitacase in the baggage compartment - More Info - EAN: 5029736062279

Sterling Silver Whitby Jet Open Fancy Pear Two Piece SetSterling Silver Whitby Jet Open Fancy Pear Two Piece Set. S035 A perfect gift for a loved one, this beautiful sterling silver and Whitby Jet two piece set features a hand carved pear shaped Whitby Jet gemstone, which is framed by an open fancy framework of solid sterling silver. Comprising of a pair of hook earrings, and necklace, complete with an 18 inch sterling silver chain. All items can be sold separately. All our Whitby Jet jewellery is designed and crafted within our very own workshops in Ashbourne, Derbyshire where a team of skilled craftsmen transform natural pieces of Whitby Jetinto these stylish pieces of jewellery. You can find other matching Whitby Jet jewellery along with matching Whitby Jet pendants on our website. All articles purchased from C W Sellors are securely dispatched with our elegant, personalised jewellery packaging. Matching items available within this collection. - More Info

Sterling Silver Whitby Jet Open Twist Heart Two Piece SetSterling Silver Whitby Jet Open Twist Heart Two Piece Set. S036 A perfect gift for a loved one, this beautiful sterling silver and Whitby Jet two piece set features a hand carved shaped Whitby Jet gemstone, which is framed by an open fancy heart shaped framework of solid sterling silver. Comprising of a pair of hook earrings, and necklace, complete with an 18 inch sterling silver chain. All items can be sold separately. All our Whitby Jet jewellery is designed and crafted within our very own workshops in Ashbourne, Derbyshire where a team of skilled craftsmen transform natural pieces of Whitby Jetinto these stylish pieces of jewellery. You can find other matching Whitby Jet jewellery along with matching Whitby Jet pendants on our website. All articles purchased from C W Sellors are securely dispatched with our elegant, personalised jewellery packaging. Matching items available within this collection. - More Info

Peppa Pig Air Peppa JetGet ready for takeoff in the Peppa Pig Air Peppa Jet! With an articulated Peppa Pig figure and two suitcases included, kids will love opening up the doors, lowering the stairs and opening the luggage hold! Simply flip over the Miss Rabbit figure, and make way for Peppa to fly the plane. Don’t leave anyone behind, because there’s room for Peppa and all of her friends inside! Suitable for ages 3 years and over. Styles may vary. Depth: 173 MM Height: 182 MM Width: 294 MM Age Range: Child (3-4 years) Character: Peppa Pig Warning Message: Warning: Not suitable for children under 3 years Free-wheeling Jet with open up cockpit. Includes articulated Peppa figure. Flip-over Miss Rabbit pilot or a seat for Peppa to fly the jet! Open the doors & lower the stairs. Load the suitacase in the baggage compartment. - More Info - EAN: 5029736062279

You may also like...

       
Apps & Games Clothing Electronics & Photo Large Appliances
Baby Womens Apparel Garden Lighting
Beauty Mens Apparel Outdoors Luggage
Books Girls Apparel Health & Personal Care Pet Supplies
Car Boys Apparel Home Shoes & Bags
Motorbike Computers & Accessories Kitchen Equipment Sports & Outdoors
Fashion DIY & Tools Jewellery Toys & Games