ESET antivirus bug let attackers achieve Home windows SYSTEM privileges

Picture: ESET

Slovak web safety agency ESET launched safety fixes to handle a excessive severity native privilege escalation vulnerability affecting a number of merchandise on programs operating Home windows 10 and later or Home windows Server 2016 and above.

The flaw (CVE-2021-37852) was reported by Michael DePlante of Development Micro’s Zero Day Initiative, and it allows attackers to escalate privileges to NT AUTHORITYSYSTEM account rights (the very best degree of privileges on a Home windows system) utilizing the Home windows Antimalware Scan Interface (AMSI).

AMSI was first launched with Home windows 10 Technical Preview in 2015, and it permits apps and providers to request reminiscence buffer scans from any main antivirus product put in on the system.

In line with ESET, this may solely be achieved after attackers achieve SeImpersonatePrivilege rights, usually assigned to customers within the native Directors group and the machine’s native Service account to impersonate a shopper after authentication which ought to “restrict the affect of this vulnerability.”

Nonetheless, ZDI’s advisory says attackers are solely required to “get hold of the power to execute low-privileged code on the goal system,” which matches ESET’s CVSS severity score additionally exhibiting that the bug might be exploited by menace actors with low privileges.

Whereas ESET mentioned it solely discovered about this bug on November 18, a disclosure timeline obtainable in ZDI’s advisory reveals that the vulnerability was reported 4 months earlier, on June 18, 2021.

Affected ESET merchandise

The record of merchandise impacted by this vulnerability is kind of lengthy, and it contains:

• ESET NOD32 Antivirus, ESET Web Safety, ESET Sensible Safety, and ESET Sensible Safety Premium from model 10.0.337.1 to fifteen.0.18.0
• ESET Endpoint Antivirus for Home windows and ESET Endpoint Safety for Home windows from model 6.6.2046.0 to 9.0.2032.4
• ESET Server Safety for Microsoft Home windows Server 8.0.12003.0 and eight.0.12003.1, ESET File Safety for Microsoft Home windows Server from model 7.0.12014.0 to 7.3.12006.0
• ESET Server Safety for Microsoft Azure from model 7.0.12016.1002 to 7.2.12004.1000
• ESET Safety for Microsoft SharePoint Server from model 7.0.15008.0 to eight.0.15004.0
• ESET Mail Safety for IBM Domino from model 7.0.14008.0 to eight.0.14004.0
• ESET Mail Safety for Microsoft Change Server from model 7.0.10019 to eight.0.10016.0

Customers of ESET Server Safety for Microsoft Azure are additionally suggested to right away replace ESET File Safety for Microsoft Azure to the most recent obtainable model of ESET Server Safety for Microsoft Home windows Server to handle the flaw.

The antivirus maker launched a number of safety updates between December 8 and January 31 to handle this vulnerability, when it patched the final susceptible product uncovered to assaults.

Fortunately, ESET discovered no proof of exploits designed to focus on merchandise affected by this safety bug within the wild.

“The assault floor can be eradicated by disabling the Allow superior scanning by way of AMSI possibility in ESET merchandise’ Superior setup,” ESET added.

“Nonetheless, ESET strongly recommends performing an improve to a set product model and solely making use of this workaround when the improve just isn’t attainable for an essential motive.”