Windows zero-day flaw giving admin rights gets unofficial patch, again

-

 

A Windows local privilege escalation zero-day vulnerability that Microsoft has failed to fully address for several months now, allows users to gain administrative privileges in Windows 10, Windows 11, and Windows Server.

The locally exploited vulnerability in Windows User Profile Service is tracked as CVE-2021-34484 and was given a CVSS v3 score of 7.8. While exploits have been publicly disclosed in the past, they are not believed to be actively exploited in the wild.

The peculiarity of this case lies in the fact that Microsoft has been unable to address the flaw since its discovery last summer and that it has marked the bug as fixed twice.

Top ArticlesPhishing kits constantly evolve to evade security softwareMorgan Stanley client accounts breached in social engineering attacksUS charges 4 Russian govt employees with critical infrastructure hacksREAD MOREWestern Digital My Cloud OS update fixes critical vulnerabilityLapsus$ suspects arrested for Microsoft, Nvidia, Okta hacksMalicious Microsoft Excel add-ins used to deliver RAT malwareUS charges 4 Russian govt employees withcritical infrastructure hacks

US charges 4 Russian govt employees with critical infrastructure hacks

According to the 0patch team, which has been unofficially providing fixes for discontinued Windows versions and some vulnerabilities that Microsoft won't address, the flaw is still a zero-day. In fact, Microsoft's patches failed to fix the bug and broke 0patch's previous unofficial patch.

The LPE that won't stay fixed

The Windows User Profile Service Elevation of Privilege Vulnerability, tracked as CVE-2021-34484, was discovered by security researcher Abdelhamid Naceri and disclosed to Microsoft, who fixed it as part of the August 2021 Patch Tuesday.

Soon after the fix was released, Naceri noticed that Microsoft’s patch was incomplete and presented a proof of concept (PoC) that bypassed it on all Windows versions.

CVE-2021-34484​​​​​​​ Exploit launching an elevated command prompt with SYSTEM privileges
CVE-2021-34484 Exploit launching an elevated command prompt with SYSTEM privileges
Source: BleepingComputer

The 0patch team stepped in at that point, releasing an unofficial security update for all Windows versions and making it free to download for all registered users.

Microsoft also responded to this bypass with a second security update released with the January 2022 Tuesday Patch Tuesday, giving the bypass a new tracking ID as CVE-2022-21919 and marking it as fixed. However, Naceri found a way to bypass that fix while commenting that this attempt was worse than the first.

While testing their patch against the researcher's second bypass, 0patch found that their patch to the "profext.dll" DLL still protected users against the new exploitation method, allowing those systems to remain secure.

However, Microsoft's second fixing attempt replaced the "profext.dll" file, leading to the removal of the unofficial fix from everyone who had applied the January 2022 Windows updates.

0patch has now ported the fix to work with the March 2022 Patch Tuesday updates and made it available for free to all registered users. 

The Windows versions that can take advantage of the new micro-patch are the following:

  • Windows 10 v21H1 (32 & 64 bit) updated with March 2022 Updates
  • Windows 10 v20H2 (32 & 64 bit) updated with March 2022 Updates
  • Windows 10 v1909 (32 & 64 bit) updated with March 2022 Updates
  • Windows Server 2019 64 bit updated with March 2022 Updates

It should be noted that Windows 10 1803, Windows 10 1809, and Windows 10 2004 are still protected by 0patch's original patch, as those devices have reached the end of support and did not receive the Microsoft update that replaced the DLL.

How to install the micro-patch

The micro-patch will remain available as a free download to users of the above Windows versions as long as Microsoft hasn't released a complete fix for the particular LPE problem and all its bypasses.

To those interested in taking up that offering, update your Windows 10 to the latest patch level (March 2022), create a free account in 0patch Central, and then install and register the 0patch Agent from here.

Doing that will initiate an automated micro-patching process with no manual actions or reboots required for the chances to take effect on your system.

Bleeping Computer has contacted Microsoft to ask if it's planning to revisit the particular flaw and maybe try and fix it via a security update in the future, and a spokesperson of the company has shared the following comment:

"We're aware of this report and will take action as needed to protect customers."


Comments

Post a Comment

Popular posts from this blog

Will robots take over? The rising opportunity of AI and aging in Asia

-
Image
In this series, we asked speakers at the  Milken Institute Asia Summit  to make one prediction for where Asia is headed in the next 20 years. Join the conversation by writing your own article  here  and including  #MIGlobal . Follow  the Milken Institute  to get updates from the Asia Summit. Deep in the manufacturing heartland of Asia, assembly lines buzz with robots manufacturing fellow robotics. Meanwhile, it is morning in Tokyo, and a recently retired businessman awakes to find his bed sensors have delivered a diagnostic report to a remote telehealth facility that monitors his well-being and warns of impending issues. His food delivery service drone arrives with his dietary needs for the day, and he enjoys his breakfast followed by a virtual reality meditation session with his former colleagues. A science fiction scenario of the distant future? Or a present-day reality? The dichotomy between machine and man has engaged humankind throughout ...
Read more

Cloud-seeding experiments take off in India

-
Image
The government hopes to enhance rain in drought-hit Karnataka Over the next 60 days, cloud-seeding will take place in Karnataka [Jagadeesh NV/EPA] A cloud-seeding project is finally under way in the Indian state of Karnataka. The experiment hopes to bring extra water to the state that has seen three years of drought. The project, named Varshadhare, has been delayed by 10 days, after problems getting GST (Goods and Services Tax) clearance for the radar equipment. The initial flight on Monday at Jakkur Airfield was further delayed, according to the New Indian Express, after missing its scheduled take off slot and failing to get clearance from air traffic control until late afternoon. By the time it took off, most of the clouds had cleared, but officials noted that this was just a demonstration flight and the cloud-seeding would begin in earnest from Wednesday. Over the next 60 days, a small plane will spray sodium chloride, potassium chloride and...
Read more

Reggae Artiste Blakk Rasta back on air

-
Image
Blakk Rasta is said to be heading to Accra-based radio Zylofon 102.1FM. Reggae artiste and radio presenter, Abubakar Ahmed aka Blakk Rasta, is set to make a big comeback on air, hopeful in October, it has been reported. The lead advocate for the legalisation of marijuana in Ghana is said to be heading to an Accra-based radio station located at East Legon. The former Hitz FM presenter, who was fired after a row with Members of Parliament, is said to have been signed by Zylofon 102.1FM. Blakk Rasta had hinted, in an interview with TV personality Mikky Osei Berko on his "Happy Hour" show earlier, that he will be on radio in October. play Blakk Rasta reportedly signed by Zylofon 102.1FM. "My return to the console will shake the country”, he said. “I will be on radio next month and the fire will be hotter than hell," he added. The reggae singer, after he was sacked from Hitz FM, took up a lecturing job at the University of Central Missouri, a public s...
Read more