Unpatched Unauthorized File Learn Vulnerability Impacts Microsoft Home windows OS

Unofficial patches have been issued to remediate an improperly patched Home windows safety vulnerability that might enable data disclosure and native privilege escalation (LPE) on susceptible methods.

Tracked as CVE-2021-24084 (CVSS rating: 5.5), the flaw issues an data disclosure vulnerability within the Home windows Cell Machine Administration element that might allow an attacker to realize unauthorized file system entry and browse arbitrary information.

Safety researcher Abdelhamid Naceri was credited with discovering and reporting the bug in October 2020, prompting Microsoft to handle the difficulty as a part of its February 2021 Patch Tuesday updates.

However as noticed by Naceri in June 2021, not solely may the patch be bypassed to attain the identical goal, the researcher this month discovered that the incompletely patched vulnerability may be exploited to realize administrator privileges and run malicious code on Home windows 10 machines working the newest safety updates.

“Particularly, as HiveNightmare/SeriousSAM has taught us, an arbitrary file disclosure will be upgraded to native privilege escalation if you already know which information to take and what to do with them,” 0patch co-founder Mitja Kolsek mentioned in a publish final week.

Nonetheless, it is value noting that the vulnerability will be exploited to perform privilege escalation solely underneath particular circumstances, specifically when the system safety function is enabled on C: Drive and a minimum of one native administrator account is about up on the pc.

Neither Home windows Servers nor methods working Home windows 11 are affected by the vulnerability, however the next Home windows 10 variations are impacted —

• Home windows 10 v21H1 (32 & 64 bit) up to date with November 2021 Updates
• Home windows 10 v20H2 (32 & 64 bit) up to date with November 2021 Updates
• Home windows 10 v2004 (32 & 64 bit) up to date with November 2021 Updates
• Home windows 10 v1909 (32 & 64 bit) up to date with November 2021 Updates
• Home windows 10 v1903 (32 & 64 bit) up to date with November 2021 Updates
• Home windows 10 v1809 (32 & 64 bit) up to date with Might 2021 Updates

CVE-2021-24084 can be the third zero-day Home windows vulnerability to rear its head once more as a consequence of an incomplete patch issued by Microsoft. Earlier this month, 0patch shipped unofficial fixes for an area privilege escalation vulnerability (CVE-2021-34484) within the Home windows Consumer Profile Service that allows attackers to realize SYSTEM privileges.

Then final week, Naceri disclosed particulars of one other zero-day flaw within the Microsoft Home windows Installer service (CVE-2021-41379) that may very well be bypassed to attain elevated privileges on units working the most recent Home windows variations, together with Home windows 10, Home windows 11, and Home windows Server 2022.