Google, Microsoft say Chinese hackers are exploiting SharePoint zero-day
-
This is a zero-day bug though?
Read the article
-
Even then this clearly effects US' federal government so all this talk of domestic security for bringing back businesses to US are quite laughable with this context.
All what?
-
That’s not a zero-day… Really dislike media that waters down or misuse terminology
So that would make it a zero-oneandahalf-week.
-
almost makes one forget this is a problem that Microsoft created.
Well yes these type of things can happen to virtually any type of complex software to anyone. Though the lacking response is concerning.
-
This is a zero-day bug though?
It's not, the title lies.
-
SharePoint is a nightmare.
Agree. I work with an org that uses SharePoint, I don't. When they share docs with me, I can't directly transfer (or maybe I haven't found how) to One drive. I mean, they are both MS Cloud. Why?
-
Well yes these type of things can happen to virtually any type of complex software to anyone. Though the lacking response is concerning.
concerning
Or a trend.
-
Read the article
I did.. It looks like the bug has been exploited for a couple of weeks now, with a patch only being released on 20th of July? That makes it zero-day
The bug is regarded as a zero-day because the vendor — Microsoft, in this case — had no time to issue a patch before it was actively exploited.
Edit: realised we might have different definition of zero day. Depends whether you consider that the vendor didn't know about the issue, or there isn't a patch available upon exploitation of the vulnerability.
-
SharePoint is a nightmare.
Micro$oft is a nightmare.
Heck, all of big tech is a nightmare.
-
I did.. It looks like the bug has been exploited for a couple of weeks now, with a patch only being released on 20th of July? That makes it zero-day
The bug is regarded as a zero-day because the vendor — Microsoft, in this case — had no time to issue a patch before it was actively exploited.
Edit: realised we might have different definition of zero day. Depends whether you consider that the vendor didn't know about the issue, or there isn't a patch available upon exploitation of the vulnerability.
Zero day is typically defined as there being zero days since the vulnerability is known to the developer, in other words, it being unknown at the time of the exploit.
-
Zero day is typically defined as there being zero days since the vulnerability is known to the developer, in other words, it being unknown at the time of the exploit.
Ah thank you. I thought zero day and 1 day vulnerabilities were:
0-day = vulnerability is not known to the vendor and so there is no patch. If exploited, it is a 0-day attack.
1-day = vulnerability is known and patch is available, but not all systems are patched.I.E. the actual number of days doesn't matter.