Security News > 2021 > November > Zero-day proof-of-concept exploit lands for Windows make-me-admin vulnerability
The day has a 'y' in it, so it must be time for another zero day to drop for a Microsoft product.
To be clear, one does need to be logged into a Windows box to elevate one's privileges, and it looks like Edge also needs to be installed - which is hard to avoid in most modern Windows installations these days.
Naceri discovered the security hole while looking into Microsoft's fix for CVE-2021-41379, a vulnerability he had disclosed to the Windows giant previously.
As for the original issue, CVE-2021-41379, the vulnerability was related to the Windows Installer service, which could be abused to delete files or directories.
"Any attempt to patch the binary directly will break Windows Installer," he went on.
The Register contacted Microsoft regarding this vulnerability and will update should the IT goliath respond.
News URL
https://go.theregister.com/feed/www.theregister.com/2021/11/23/windows_lpe/
Related news
- LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers (source)
- New Mirai botnet targets industrial routers with zero-day exploits (source)
- Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks (source)
- Security pros baited with fake Windows LDAP exploit traps (source)
- Zero-day exploits plague Ivanti Connect Secure appliances for second year running (source)
- Zero-Day Vulnerability in Ivanti VPN (source)
- Nominet probes network intrusion linked to Ivanti zero-day exploit (source)
- Hackers Exploit Aviatrix Controller Vulnerability to Deploy Backdoors and Crypto Miners (source)
- Microsoft fixes actively exploited Windows Hyper-V zero-day flaws (source)
- Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-10 | CVE-2021-41379 | Link Following vulnerability in Microsoft products Windows Installer Elevation of Privilege Vulnerability | 0.0 |