Security News > 2021 > November > Zero-day proof-of-concept exploit lands for Windows make-me-admin vulnerability
The day has a 'y' in it, so it must be time for another zero day to drop for a Microsoft product.
To be clear, one does need to be logged into a Windows box to elevate one's privileges, and it looks like Edge also needs to be installed - which is hard to avoid in most modern Windows installations these days.
Naceri discovered the security hole while looking into Microsoft's fix for CVE-2021-41379, a vulnerability he had disclosed to the Windows giant previously.
As for the original issue, CVE-2021-41379, the vulnerability was related to the Windows Installer service, which could be abused to delete files or directories.
"Any attempt to patch the binary directly will break Windows Installer," he went on.
The Register contacted Microsoft regarding this vulnerability and will update should the IT goliath respond.
News URL
https://go.theregister.com/feed/www.theregister.com/2021/11/23/windows_lpe/
Related news
- RomCom Exploits Zero-Day Firefox and Windows Flaws in Sophisticated Cyberattacks (source)
- RomCom hackers chained Firefox and Windows zero-days to deliver backdoor (source)
- Firefox and Windows zero-days exploited by Russian RomCom hackers (source)
- New Windows Server 2012 zero-day gets free, unofficial patches (source)
- PoC exploit for critical WhatsUp Gold RCE vulnerability released (CVE-2024-8785) (source)
- Mitel MiCollab zero-day flaw gets proof-of-concept exploit (source)
- Mitel MiCollab zero-day and PoC exploit unveiled (source)
- New Windows zero-day exposes NTLM credentials, gets unofficial patch (source)
- New Malware Technique Could Exploit Windows UI Framework to Evade EDR Tools (source)
- LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-10 | CVE-2021-41379 | Link Following vulnerability in Microsoft products Windows Installer Elevation of Privilege Vulnerability | 0.0 |