{"id":485401,"date":"2023-03-27T12:43:46","date_gmt":"2023-03-27T10:43:46","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=485401"},"modified":"2023-03-27T12:46:03","modified_gmt":"2023-03-27T10:46:03","slug":"microsoft-rolls-out-fix-for-windows-screenshot-flaw","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/485401-microsoft-rolls-out-fix-for-windows-screenshot-flaw.html","title":{"rendered":"Microsoft issues patch for aCropalypse bug"},"content":{"rendered":"

Microsoft has released an update<\/a><\/strong> addressing a screenshot-snipping vulnerability in Windows 10 and 11 that could let malicious actors recover edited parts of screenshots to view sensitive information.<\/p>\n

Dubbed the “aCropalypse”, Microsoft says the security flaw \u2014 tracked as CVE-2023-28303 \u2014 relates to both the Snip & Sketch app in Windows 10 and the Snipping Tool in Windows 11.<\/p>\n

“The severity of this vulnerability is Low because successful exploitation requires uncommon user interaction and several factors outside of an attacker’s control,” Microsoft said.<\/p>\n

However, the tech giant noted that the vulnerability only applies to images created in a specific way, including those saved, edited, and then saved over the original file and those opened in the Snipping Tool, edited, and then saved in the same location.<\/p>\n

Microsoft specified that screenshots modified before saving, and those copied and pasted were unaffected by the security flaw.<\/p>\n

Windows users can update the affected apps by going to the Microsoft Store, selecting Library, and clicking Get Updates.<\/p>\n

Those with automatic updates enabled should see their Snipping Tool set to version 10.2008.3001.0 or their Snip & Sketch tool version set to 11.2302.20.0.<\/p>\n

Software developer Chris Blume discovered the vulnerability \u2014 which could allow bad actors to potentially recover and view cropped PNG data<\/a><\/strong> \u2014 on Tuesday, 21 March 2023.<\/p>\n

Cybersecurity researcher David Buchanan confirmed that extraction of the cropped data is achievable using a modified version of a script used to demonstrate a similar vulnerability within the Android operating system.<\/p>\n

“Windows Snipping Tool is vulnerable to aCropalypse too. An entirely unrelated codebase,” Buchanan said.<\/p>\n

“The same exploit script works with minor changes (the pixel format is RGBA not RGB). Tested myself on Windows 11.”<\/p>\n

Buchanan and programmer Simon Aarons had previously discovered the “aCropalypse” vulnerability in the screenshot editing tool on Google Pixel phones.<\/p>\n

\n

Now read: Hacking team wins a second Tesla Model 3 and R6.5 million at Pwn2Own<\/a><\/h2>\n","protected":false},"excerpt":{"rendered":"

Microsoft has released a security update for a screenshot vulnerability impacting the Windows 10 Snip & Sketch and the Windows 11 Snipping Tool programmes.<\/p>\n","protected":false},"author":341076,"featured_media":464145,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[85079,123,85141,83239,26970,70233],"class_list":["post-485401","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-acropalypse","tag-microsoft","tag-snip-sketch","tag-snipping-tool","tag-windows-10","tag-windows-11"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/485401"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341076"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=485401"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/485401\/revisions"}],"predecessor-version":[{"id":485459,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/485401\/revisions\/485459"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/464145"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=485401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=485401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=485401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}