Security News > 2021 > November > Zero-day proof-of-concept exploit lands for Windows make-me-admin vulnerability
The day has a 'y' in it, so it must be time for another zero day to drop for a Microsoft product.
To be clear, one does need to be logged into a Windows box to elevate one's privileges, and it looks like Edge also needs to be installed - which is hard to avoid in most modern Windows installations these days.
Naceri discovered the security hole while looking into Microsoft's fix for CVE-2021-41379, a vulnerability he had disclosed to the Windows giant previously.
As for the original issue, CVE-2021-41379, the vulnerability was related to the Windows Installer service, which could be abused to delete files or directories.
"Any attempt to patch the binary directly will break Windows Installer," he went on.
The Register contacted Microsoft regarding this vulnerability and will update should the IT goliath respond.
News URL
https://go.theregister.com/feed/www.theregister.com/2021/11/23/windows_lpe/
Related news
- Proof-of-Concept Exploit Released for Progress Software OpenEdge Vulnerability (source)
- Hackers exploit Windows SmartScreen flaw to drop DarkGate malware (source)
- Researchers Detail Kubernetes Vulnerability That Enables Windows Node Takeover (source)
- PoC exploit for critical Fortra FileCatalyst MFT vulnerability released (CVE-2024-25153) (source)
- Microsoft fixes two Windows zero-days exploited in malware attacks (source)
- Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks (source)
- Telegram fixes Windows app zero-day caused by file extension typo (source)
- Telegram fixes Windows app zero-day used to launch Python scripts (source)
- Exploit code for Palo Alto Networks zero-day now public (source)
- Microsoft: APT28 hackers exploit Windows flaw reported by NSA (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-10 | CVE-2021-41379 | Link Following vulnerability in Microsoft products Windows Installer Elevation of Privilege Vulnerability | 5.5 |