A critical vulnerability has been uncovered in an obscure Microsoft Corp. module that can easily be exploited in versions of Windows dating back as far as Windows XP.

Discovered by Google security researcher Tavis Ormandy, the vulnerability comes via the Windows CTF module. No one seems to know what CTF stands for, but the module is a part of the Windows Text Services Framework that manages input methods such as text processing, system language and keyboard inputs.

The vulnerability relates to the way communications between CTF clients and CTF servers — that is, the devices and the Windows installation using the module to communicate. No authentication is used, allowing attackers to insert their own malicious code that would allow them to take remote control of a computer running Windows.

“It turns out it was possible to reach across sessions and violate NT security boundaries for nearly twenty years, and nobody noticed,” Ormandy wrote today.

Ormandy initially informed Microsoft of his findings, but the company was apparently slow to respond. That said, a patch for the vulnerability, named CVE-2019-1162, has now been made available but only for supported Windows releases. Older, unsupported versions of Windows remain vulnerable.

“This technique can be exploited by a local user, so it does require the attacker having a user session on the machine,” Richard Gold, head of security engineering at risk protection firm Digital Shadows Ltd., told SiliconANGLE. “It is not a technique for gaining initial access to a machine, but for elevating privileges after a successful intrusion.”

Chris Morales, head of security analytics at Vectra AI Inc. said the vulnerabilities also allow for a privilege escalation after an attacker gains access to a system with a user account.

“Normally, an unprivileged process would not be permitted to send input or read data from a high privileged process,” Morales explained. “CTF breaks these assumptions, and allows unprivileged processes to send input to privileged processes.”

So if attackers can gain access to an unprivileged user on a system, they could then use an exploit to trigger a command to privileged processes, he added.

Image: nperlapro/Flickr