CVE-2022-26809 MS-RPC Vulnerability Analysis - SANS Institute

Channel:

SANS Institute

Subscribers:

64,000

Published on April 18, 2022 12:14:07 AM ● Video Link: https://www.youtube.com/watch?v=fQ06VUq3kd8

Duration: 59:05

6,944 views

107

On Tuesday, April 12th, Microsoft released patches for CVE-2022-26809, reportedly a zero-click exploit targeting Microsoft RPC services. At the time of the publication of this abstract, there is no proof of concept available in the wild. However, based on the rating that exploitation is "more likely" we expect this won't last long. In this webcast, we'll discuss:

- Background on Microsoft RPC (so you can talk intelligently about it)
- Where the vulnerability lies within rpcrt4.dll
- Steps you can take to limit exploitation
- Logging to enable that is likely to capture exploitation attempts

SANS is the most trusted and by far the largest source for information security training and security certification in the world. It also develops, maintains, and makes available at no cost, the largest collection of research documents about various aspects of information security, and it operates the Internet's early warning system - the Internet Storm Center.