Prevx发现Windows UAC漏洞
                                                                                                                                                           Prevx有详细的一系列报导，可参考：http://www.prevx....og.asp

TrendLabs Malware Blog也发表看法。注意，根据趋势的说法，现在已经有Zero-Day出现：引用:

Yet another zero-day vulnerability recently reared its ugly head in the threat landscape. Discovered by Marco Giuliani at Prevx, the proof of concept (POC) shows that a vulnerable application programming interface (API) in Windows can be manipulated by changing its input to cause an overflow in the kernel that will allow arbitrary code to run in kernel mode. As proven in our internal testing, the POC described by the author is capable of elevating system privileges without the user’s knowledge even in more recent Windows OS versions that utilize user account control (UAC).



The timing of the POC’s release is particularly crucial, considering the upcoming Thanksgiving holidays. With users spending more time online in search of discounts and Black Friday deals, it may become easier for cybercriminals to spread malware exploiting the zero-day vulnerability. Users are thus advised to exercise caution when conducting their usual online activities.

Analysis and screenshot provided by threat analyst Edgardo Diaz, Jr.
原文，可参考：http://blog.trendmicro.com/zero...-windows-uac/