Wednesday, February 8, 2023
  • Events
  • Interviews
  • Jobs
  • Opinion
  • Whitepapers
  • Glossary
  • Community Forum
  • Web Hosting Directory
  • Login
  • Register
Cloud7 News
  • Cloud Computing
  • Web Hosting
  • Data Center
  • Linux
  • Cybersecurity
  • More
    • Network/Internet
    • Windows
    • Software
    • Hardware
    • Blockchain
    • Policy/Legislation
    • How-Tos
    • Troubleshooting
No Result
View All Result
Cloud7 News
  • Cloud Computing
  • Web Hosting
  • Data Center
  • Linux
  • Cybersecurity
  • More
    • Network/Internet
    • Windows
    • Software
    • Hardware
    • Blockchain
    • Policy/Legislation
    • How-Tos
    • Troubleshooting
No Result
View All Result
Cloud7 News
No Result
View All Result

Home > Cybersecurity > Update your PowerShell to fix the WDAC bypass vulnerability

Update your PowerShell to fix the WDAC bypass vulnerability

WDAC protects Windows devices against potential malicious software by checking the applications and drivers running whether they are in the trusted apps list or not.


Atalay Kelestemur Atalay Kelestemur
October 18, 2021
1 min read
Update your PowerShell to fix the WDAC bypass vulnerability

Microsoft announced a patch for PowerShell 7 that fixes two vulnerabilities allowing attackers to bypass WDAC (Windows Defender Application Control) enforcement and gain access to credentials written in plain text. Microsoft released PowerShell 7.0.8 and PowerShell 7.1.5 to fix the vulnerabilities in PowerShell version 7 and 7.1 branches in September and October.

Security flaws in PowerShell

WDAC protects Windows devices against potential malicious software by checking the applications and drivers running whether they are in the trusted apps list or not. If the application is in the list, it allows Windows operating system to run the software. Otherwise, it blocks the malware or unwanted software from launching. If the WDAC security layer is enabled, PowerShell automatically goes in to constrained language mode and allows access to only a limited set of Windows APIs.

When the vulnerability tracked as CVE-2020-0951 is exploited, the attacker can bypass the Windows Defender Application Control security feature by manipulating the WDAC allow-list, and execute PowerShell commands, which in normal conditions should be blocked when WDAC is enabled. The second vulnerability is tracked as CVE-2021-41355 is an information disclosure in .NET Core. By exploiting this vulnerability, the attacker can access the credentials in clear text on devices running non-Windows platforms.

To check the PowerShell version, you can execute the command below, from the Command Prompt. If your version is lower than the versions mentioned above, we strongly advice you to update your PowerShell to the secure versions that are PowerShell 7.0.8 and PowerShell 7.1.5 as soon as possible.

pwsh -v

See more Cybersecurity News


Tags: Vulnerability
Atalay Kelestemur

Atalay Kelestemur

Atalay Kelestemur is the Editor-in-Chief of Cloud7 News. Also, he is the Program Manager of AlmaLinux OS, an open-source, community-driven Linux operating system. He was most recently the chief editor of T3. Prior to that, he was the managing editor of BYTE. He also served as a software editor in PC World. Atalay Kelestemur has covered the technology industry since 1996, publishing articles in PC Net, IT Pro, Computer World, PC Life, CyberMag, and CIO magazines. Atalay Kelestemur is an information system security professional and his area of expertise includes Linux security, penetration testing, secure software development, malware removal, and computer forensics. Atalay Kelestemur is the author of Pardus 2011, Ubuntu, Windows 8, and Siber Istihbarat (Cyber Intelligence). Atalay graduated with a Bachelor's Degree in Maritime from Istanbul Technical University. He earned a master's degree in political science from Gedik University, where he wrote his thesis on The Importance of Cyber Intelligence on Public Security. Now he is working on his Ph.D. thesis on international trade, covering the cybersecurity threats and countermeasures on the maritime industry.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

I agree to the Terms & Conditions and Privacy Policy.

Next Post
OVHcloud makes its debut on Euronext Paris

OVHcloud makes its debut on Euronext Paris

Related News

New local privilege escalation vulnerability strikes X.Org server

New local privilege escalation vulnerability strikes X.Org server

February 7, 2023 9:45 pm
Red Hat brings new security capabilities to Red Hat OpenShift

Red Hat brings new security capabilities to Red Hat OpenShift

February 7, 2023 8:55 pm
Cisco fixes command injection vulnerability

Cisco fixes command injection vulnerability

February 6, 2023 5:00 pm
Fortra's GoAnywhere managed file transfer is under attack

Fortra’s GoAnywhere managed file transfer is under attack

February 6, 2023 4:00 pm
Get free daily newsletters from Cloud7 News Get the Cloud7 Newsletter
Select list(s):

Check your inbox or spam folder to confirm your subscription.

By subscribing, you agree to our
Copyright Policy and Privacy Policy

Get the free newsletter

Subscribe to receive the latest IT business updates straight to your inbox.

Select list(s):

Check your inbox or spam folder to confirm your subscription.

Editor's Choice

What’s new in Linux kernel 6.2 rc6?

10 Best Web Hosting Services of 2023

Ubuntu 22.04 LTS is available for download. What is new?

CERN and Fermilab recommend AlmaLinux

7 best hosting control panels of 2023

How to update Linux Kernel without rebooting?

7 best Linux mail servers of 2023

7 best cPanel alternatives for 2023

7 best Linux web browsers for 2023

7 best CentOS alternatives

7 best Linux server distros of 2023

Interview with Igor Seletskiy on AlmaLinux

How to create a VM on VMware Workstation

Recent News

  • New local privilege escalation vulnerability strikes X.Org server
  • Red Hat brings new security capabilities to Red Hat OpenShift
  • With BuddyPress 12.0, BP Rewrites will support backward compatibility
  • Dell to lay off 6,650 employees
  • Canonical joins the Academy Software Foundation

Cloud7 News
Cloud7 is a news source that publishes the latest news, reviews, comparisons, opinions, and exclusive interviews to help tech users of high-experience levels in the IT industry.

EXPLORE

  • Web Hosting
  • Cloud Computing
  • Data Center
  • Cybersecurity
  • Linux
  • Network/Internet
  • Software
  • Hardware
  • How-Tos
  • Troubleshooting

RESOURCES

  • Events
  • Interviews
  • Jobs
  • Opinion
  • Whitepapers
  • Glossary
  • Community Forum
  • Web Hosting Directory

Get the Cloud7 Newsletter

Get FREE daily newsletters from Cloud7 delivering the latest news and reviews.

  • About
  • Privacy & Policy
  • Copyright Policy
  • Contact

© 2023, Cloud7 News. All rights reserved.

No Result
View All Result
  • Cloud Computing
  • Web Hosting
  • Data Center
  • Linux
  • Cybersecurity
  • More
    • Network/Internet
    • Windows
    • Software
    • Hardware
    • Blockchain
    • Policy/Legislation
    • How-Tos
    • Troubleshooting
  • Events
  • Interviews
  • Jobs
  • Opinion
  • Whitepapers
  • Glossary
  • Community Forum
  • Web Hosting Directory

© 2023, Cloud7 News. All rights reserved.

Welcome Back!

Sign In with Facebook
Sign In with Google
Sign In with Linked In
OR

Login to your account below

Forgotten Password? Sign Up

Create New Account!

Sign Up with Facebook
Sign Up with Google
Sign Up with Linked In
OR

Fill the forms below to register

*By registering into our website, you agree to the Terms & Conditions and Privacy Policy.
All fields are required. Log In

Retrieve your password

Please enter your username or email address to reset your password.

Log In
This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy and Cookie Policy.