Mysterious "Follina" zero-day hole in Office

Let me guess, they will probably announce that Sophos Intercept X and HitmanPro Alert have added protection against this exploit.

 

Follina gets fixed - but it's not listed in the Patch Tuesday patches!

15 Jun 2022

https://nakedsecurity.sophos.com/2022/06/15/follina-gets-fixed-but-its-not-listed-in-the-patch-tuesday-patches/

 

This is worth reviewing in that Sophos actually verified the patch works to thwart this specific attack.

My concern, as with others, is Microsoft did not patch the RCE vulnerability. It still exists and can be expected to be used maliciously in some new unknown way in the future.

 

It also appears Microsoft's Follina patch can be bypassed. Are you surprised?

Someone just posted a mitigation for the bypass here: https://github.com/SigmaHQ/sigma/bl...ry_set/registry_set_enabling_turnoffcheck.yml