Microsoft patch fails to fix Installer zero-day affecting every version of Windows

Cyber criminals are testing out a evidence-of-concept malware that targets a zero-day escalation of privilege exploit in the Microsoft Windows Installer.

The flaw, which allows hackers with a restricted person account to elevate their privileges to come to be an administrator, has an effect on every single version of Microsoft Windows, which includes thoroughly patched Windows 11 and Server 2022.

Malware samples have by now been detected in the wild that are attempting to choose gain of this vulnerability, in accordance to a web site article by security scientists at Cisco Talos.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

It was security researcher Abdelhamid Naceri who to begin with found this elevation of privilege vulnerability and labored with Microsoft to handle it. Microsoft then launched an update that was meant to fix CVE-2021-41379 on 9 November as section of its monthly security update.

On the other hand, the patch failed to resolve the vulnerability, and Naceri printed a evidence-of-concept exploit code on GitHub on 22 Nov that however operates regardless of the fixes implemented by Microsoft.

“The code Naceri launched leverages the discretionary access regulate record (DACL) for Microsoft Edge Elevation Support to swap any executable file on the technique with an MSI file, allowing for an attacker to run code as an administrator,” said Jaeson Schultz, technological chief for Cisco’s Talos Security Intelligence & Investigation Group.

According to a submitting by Naceri on GitHub, the system could not operate on every installation, since windows installations, such as server 2016 and 2019, may well not have the elevation services.

“I deliberately remaining the code which acquire over file open, so any file specified in the first argument will be taken around with the situation that System account should have obtain to it and the file mustn’t be in use. So you can elevate your privileges on your own,” he explained.

Naceri included that the most effective workaround available at the time of producing this is to wait for Microsoft to release a security patch, due to the complexity of this vulnerability.

“Any endeavor to patch the binary instantly will split windows installer. So you improved hold out and see how Microsoft will screw the patch all over again,” he claimed.