Microsoft announced on Friday that it’s offering rewards of up to $15,000 for serious vulnerabilities found in Nano Server.
Nano Server, a new installation option available in Windows Server 2016, is a remotely administered server operating system designed for datacenters and private clouds. Nano Server is small, fast and requires fewer updates and restarts compared to Windows Server.
Microsoft says the product is ideal as a compute host for Hyper-V virtual machines, as a storage host for Scale-Out File Server, as a DNS server, or as a host for cloud apps running in a container or a VM.
The company is prepared to pay between $500 and $15,000 for vulnerabilities found in the Nano Server installation option of Windows Server 2016 Technical Preview 5 and all subsequent releases.
The bug bounty will be running for a period of three months, until July 29. The goal is to find security holes while the product is still in technical preview in an effort to minimize impact on customers after it becomes generally available.
Bug bounty hunters can earn $15,000 if they submit a high quality report and a proof-of-concept (PoC) demonstrating a remote code execution (RCE) vulnerability in Nano Server. A high quality report describing remote, unauthenticated denial-of-service (DoS), privilege escalation, or other high severity flaws in specific Nano Server DLLs can earn researchers up to $9,000.
“Important” vulnerabilities found in Nano Server DLLs, such as spoofing and information disclosure issues, are worth $500.
Microsoft pointed out that a flaw is not eligible for a reward if it’s found in versions of Nano Server earlier than Technical Preview 5, if it’s in user-generated content, and if exploitation requires admin privileges or extensive user actions.
This is not the first temporary bug bounty run by Microsoft. Last year, the company ran a two-month program for technical preview versions of the Edge web browser and a three-month program for CoreCLR and beta versions of ASP.NET.
In March, Microsoft announced that it had added OneDrive to the company’s Online Services Bug Bounty Program, with rewards ranging between $500 and $15,000.
Related: Microsoft Pays $24,000 for Authentication Flaw in Live.com
Related: Researcher Gets $13,000 for Microsoft Authentication Flaw
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
Latest News
- Chrome 114 Released With 18 Security Fixes
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Breaking Enterprise Silos and Improving Protection
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- PyPI Enforcing 2FA for All Project Maintainers to Boost Security
- Personal Information of 9 Million Individuals Stolen in MCNA Ransomware Attack
