1

Windows has offered the ability to download updates from machines in the local network for some time. My gut feeling tells me this would be a great attack vector for Windows security vulnerabilites.

Have there been security vulnerabilites (be that remote code executions, information disclosure or other) in this feature of Windows in the past?

1
  • 2
    "My gut feeling tells me this would be a great attack vector Windows security vulnerabilites." - please clarify your gut feeling, i.e. what kind of vulnerabilities you would expect here and why? Dec 19, 2023 at 4:14

1 Answer 1

2

The updates are signed. This means only updates authorized by Microsoft will be installed. If you attempt to substitute your own they will be rejected.

1
  • To be more precise: only updates signed with Microsoft's key. It is possible that something has been signed with their key, but not authorized by Microsoft. Dec 19, 2023 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .