Microsoft patch fails to fix Installer zero-day affecting every version of Windows

Cyber criminals are testing out a evidence-of-concept malware that targets a zero-day escalation of privilege exploit in the Microsoft Windows Installer.

The flaw, which allows hackers with a restricted person account to elevate their privileges to come to be an administrator, has an effect on every single version of Microsoft Windows, which includes thoroughly patched Windows 11 and Server 2022.

Malware samples have by now been detected in the wild that are attempting to choose gain of this vulnerability, in accordance to a web site article by security scientists at Cisco Talos.

✔ Approved Seller by TheCyberSecurity From Our Partners

Protect your online privacy and internet browsing via F-Secure Freedome VPN. F-Secure has proven to be a trustworthy company but not being connected to any government. F-Secure Freedome VPN encryptes all your connections to the internet in addition it hides your real IP address so no one will know from which location you are browsing the web. F-Secure Freedome VPN is Netflix and Amazon Prime friendly which means you can easily view the movies and series that are meant for Amercian viewers.

Get F-Secure Freedome VPN with 50% discount from our partner: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

It was security researcher Abdelhamid Naceri who to begin with found this elevation of privilege vulnerability and labored with Microsoft to handle it. Microsoft then launched an update that was meant to fix CVE-2021-41379 on 9 November as section of its monthly security update.

On the other hand, the patch failed to resolve the vulnerability, and Naceri printed a evidence-of-concept exploit code on GitHub on 22 Nov that however operates regardless of the fixes implemented by Microsoft.

“The code Naceri launched leverages the discretionary access regulate record (DACL) for Microsoft Edge Elevation Support to swap any executable file on the technique with an MSI file, allowing for an attacker to run code as an administrator,” said Jaeson Schultz, technological chief for Cisco’s Talos Security Intelligence & Investigation Group.

According to a submitting by Naceri on GitHub, the system could not operate on every installation, since windows installations, such as server 2016 and 2019, may well not have the elevation services.

“I deliberately remaining the code which acquire over file open, so any file specified in the first argument will be taken around with the situation that System account should have obtain to it and the file mustn’t be in use. So you can elevate your privileges on your own,” he explained.

Naceri included that the most effective workaround available at the time of producing this is to wait for Microsoft to release a security patch, due to the complexity of this vulnerability.

“Any endeavor to patch the binary instantly will split windows installer. So you improved hold out and see how Microsoft will screw the patch all over again,” he claimed.