QuoVadis Posted January 21, 2019 Report Share Posted January 21, 2019 During the last two weeks of December, a security enthusiast who uses the online handle SandboxEscaper released details and proof-of-concept exploit code for two privilege escalation vulnerabilities in Windows. Researchers from ACROS Security have released a temporary “micropatch” for one of them through 0patch, a service that provides in-memory binary patching for zero-day flaws, and they are currently testing a patch for the secondary issue as well. One of SandboxEscaper’s vulnerabilities allows a low-privileged user to read any file on the system, including those belonging to other users. The exploit abuses a Windows feature called MsiAdvertiseProduct that performs operations with SYSTEM privileges, so it can lead to information disclosure, especially if attackers know the path to potentially sensitive files they can expose. The second vulnerability is even more serious and allows low-privileged users to overwrite arbitrary files as SYSTEM, potentially leading to arbitrary code execution with the highest possible privilege. This flaw has been dubbed the AngryPolarBearBug and is the one that 0patch.com has released a micropatch for. https://github.com/SandboxEscaper/randomrepo https://www.techcentral.ie/windows-zero-day-exploit-gets-temporary-micropatch/ 2 Quote Link to comment Share on other sites More sharing options...
Nytro Posted January 21, 2019 Report Share Posted January 21, 2019 Incetul cu incetul, se dezvolta utilitatea acestor micro-patch-uri. Quote Link to comment Share on other sites More sharing options...