Privacy Ninja

Windows Installer Zero-day Vulnerability Gets Free Micropatch

Windows Installer Zero-day Vulnerability Gets Free Micropatch

A vulnerability in the Windows Installer component, which Microsoft attempted to fix several times to no avail, today received a micropatch to deny hackers the option of gaining the highest privileges on a compromised system.

The issue affects Windows 7 through 10. Microsoft’s most recent effort to address the issue (CVE-2020-16902) was in October. A bypass, complete with proof-of-concept (PoC) exploit code emerged in late December 2020.

Patch, bypass, repeat

During the installation of an MSI package, Windows Installer creates a rollback script via ‘msiexec.exe’ to revert any changes if anything goes wrong in the process.

A hacker with local privileges could run an executable with SYSTEM permissions if they could replace the rollback script with one that changes a registry value to point to their payload.

Also Read: 15 Best Tools For Your Windows 10 Privacy Settings Setup

The vulnerability popped on Microsoft’s radar and received a fix in April 2019 (CVE-2019-0841). Vulnerability researcher Sandbox Escaper found a bypass by the end of May and published some technical details.

The story repeated four more times (CVE-2019-1415CVE-2020-1302CVE-2020-0814CVE-2020-16902), and Windows Installer is still exploitable for privilege escalation to the highest permissions on a compromised machine.

The latest bypass has been disclosed by security researcher Abdelhamid Naceri on his blog along with other vulnerabilities affecting multiple security software solutions.

Temporary fix available

Mitja Kolsek, CEO of ACROS Security and co-founder of the 0patch micropatching service, explains how Naceri’s PoC for the vulnerability (no tracking number) works:

“The proof-of-concept is using a rollback script that changes the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Fax\ImagePath to c:\Windows\temp\asmae.exe, which results in the Fax Service using attacker’s asmae.exe when the service is launched. This service was used because any user is allowed to launch it, and it’s running as Local System” – Mitja Kolsek

Until Microsoft comes up with a permanent patch, a temporary one is available through the 0Patch platform. It is a single-instruction fix that does not require a reboot of the system.

The video below shows that the micropatch prevents a local non-admin user from modifying a registry value that points to the Fax Service executable, which would lead to running attacker code.

Also Read: Going Beyond DPO Meaning: Ever Heard of Outsourced DPO?

The temporary, free fix from 0Patch works for the following systems:

  • Windows 10 v20H2, 32/64bit, updated with January 2021 updates
  • Windows 10 v2004, 32/64bit, updated with January 2021 updates
  • Windows 10 v1909, 32/64bit, updated with January 2021 updates
  • Windows 7, 32/64bit, with ESU, updated with January 2021 updates
  • Windows 7, 32/64bit, without ESU, updated with January 2020 updates

Privacy Ninja provides GUARANTEED quality and results for the following CORE SERVICES:

DPO-As-A-Service (Outsourced DPO Subscription)
Vulnerability Assessment & Penetration Testing (VAPT)
PDPA Obligations for Organizational Compliance (SkillsFuture Credit Eligible)

OTHER SERVICES:

PDPA Compliance Audit
Dig
ital Transformation Consultancy
Data Protection Trustmarks Certification Readiness Consultancy

PDPA Data Protection Software
Smart Contract Audit

LIKE & SUBSCRIBE:
Facebook
LinkedIn
Twitter
YouTube
Podcast

0 Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Powered by WhatsApp Chat

× How can we help you?