A Google safety researcher has simply disclosed particulars of a 20-year-old unpatched high-severity vulnerability affecting all variations of Microsoft Windows, again from Windows XP to the newest Windows 10.
The vulnerability resides in the way in which MSCTF shoppers and server talk with one another, permitting even a low privileged or a sandboxed utility to learn and write knowledge to the next privileged utility.
MSCTF is a module in Text Services Framework (TSF) of the Windows working system that manages issues like enter strategies, keyboard layouts, textual content processing, and speech recognition.
In a nutshell, whenever you log in to your Windows machine, it begins a CTF monitor service that works as a government to deal with communications between all shoppers, which are literally home windows for every course of operating on the identical session.
“You might have noticed the ctfmon service in task manager, it is responsible for notifying applications about changes in keyboard layout or input methods. The kernel forces applications to connect to the ctfmon service when they start, and then exchange messages with other clients and receive notifications from the service,” the researcher defined.