WINDOWS UPDATE FLAWS ALLOW UNDETECTABLE DOWNGRADE ATTACKS

Summary from the TLDR InfoSec newsletter

A group of researchers from SafeBreach Labs presented a new attack at Black Hat that can be used to craft custom downgrades of critical OS components. The researchers found that a malicious action list XML file can push a Windows Downdate tool that bypasses all verification steps. Microsoft has been working with the researchers to develop a patch to prevent this attack and has released two CVEs related to it.