Microsoft today issued patches for three critical vulnerabilities in the Windows DNS client in Windows 8, Windows 10, and Windows Server 2012 and 2016 that ironically came via a security feature. The heap buffer-overflow flaws discovered by researchers at Bishop Fox – and fixed via the new CVE-2017-11779 security update amid Microsoft’s October Patch Tuesday batch – could allow an attacker to wrest away full control of the targeted Windows machine without the victim taking any action at all.

Read full news article on Dark Reading: Cloud