Update: Hacker Disclosed 4 New Microsoft Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0841 | Local Privilege Escalation via Hard-Link Flaw in Windows AppX Deployment Service CVE-2019-0841 is a local privilege escalation flaw in the Windows AppX Deployment Service (AppXSVC), which handles deployment of packaged (AppX) applications. The service improperly handles hard links (CWE-59), letting a local attacker manipulate hard links so that AppXSVC performs file operations in protected locations with elevated rights. A successful exploit allows the attacker to run processes in an elevated context — effectively administrative/SYSTEM privileges — which ransomware operators have used in chained attacks. Any unpatched Microsoft Windows system is potentially affected; the available data lists only 'Microsoft Windows' without specific version ranges, so defenders should consult Microsoft's advisory for exact affected releases. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, and EPSS assigns a 41.4% probability of exploitation within 30 days (99th percentile), although no public proof-of-concept is catalogued. Do: Apply Microsoft's Windows cumulative updates per vendor instructions as the KEV required action, prioritizing systems where users can log on locally, since exploitation requires local access; the fix shipped in Microsoft's April 2019 security release, so confirm no hosts remain on older builds. Because ransomware operators chain this local privilege escalation, verify patch status across the estate with your inventory tooling and monitor for unexpected elevation or hard-link manipulation on AppXSVC as interim risk reduction. | 7.8 | 41% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows endpoints potentially in scope (Windows runs on 1B+ active devices, ~70% desktop share), limited to unpatched systems | |
| CVE-2019-0863 | Local Privilege Escalation Flaw in Microsoft Windows Error Reporting (WER) CVE-2019-0863 is an elevation of privilege vulnerability in Microsoft Windows Error Reporting (WER), caused by the way WER handles files on affected Windows releases. A local attacker who can already execute code on a vulnerable machine with limited privileges can trigger the flaw without user interaction and gain higher local privileges, with high impact on confidentiality, integrity, and availability per the CVSS vector. Anyone running the listed releases is affected: Windows 10 versions 1507 through 1903, Windows 7, Windows 8.1, Windows RT 8.1, and Windows Server versions 1803 and 1903; systems current on Microsoft's security updates are not vulnerable. The flaw is confirmed exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 (ransomware association unknown) — although no public proof-of-concept is known, and EPSS puts the 30-day exploitation probability at 5.2% (92nd percentile). The required action per CISA is to apply updates per vendor instructions. Do: Apply Microsoft's security updates for each affected release as the CISA KEV entry requires; the flaw was fixed in 2019 cumulative updates, so any system current on monthly servicing is already protected. Prioritize patching multi-user and remote-access systems (RDS/VDI hosts, jump boxes, shared workstations) where low-privileged users can run code and escalate, and migrate unpatched Windows 7/8.1/RT 8.1 machines — many now past end of support — to a supported, patched Windows release. | 7.8 | 5% | KEV |
| masshundreds of thousands to millions of currently unpatched Windows endpoints (affected releases once ran on hundreds of millions of devices) |
Full article686 words · extracted from thehackernews.com · click to collapse
The Hacker NewsMay 23, 2019
Less than 24 hours after publicly disclosing an unpatched zero-day vulnerability in Windows 10, the anonymous hacker going by online alias "SandboxEscaper" has now dropped new exploits for two more unpatched Microsoft zero-day vulnerabilities.
The two new zero-day vulnerabilities affect Microsoft's Windows Error Reporting service and Internet Explorer 11.
Just yesterday, while releasing a Windows 10 zero-day exploit for a local privilege escalation bug in Task Scheduler utility, SandboxEscaper claimed to have discovered four more zero-day bugs, exploits for two has now been publicly released.
AngryPolarBearBug2 Windows Bug
One of the latest Microsoft zero-day vulnerabilities resides in the Windows Error Reporting service that can be exploited using a discretionary access control list (DACL) operation—a mechanism that identifies users and groups that are assigned or denied access permissions to a securable object.
Upon successful exploitation, an attacker can delete or edit any Windows file, including system executables, which otherwise only a privileged user can do.
Dubbed AngryPolarBearBug2 by the hacker, the vulnerability is a successor to a previous Windows Error Reporting service vulnerability she found late last year, which was named AngryPolarBearBug and allowed a local, unprivileged attacker to overwrite any chosen file on the system.
However, as SandboxEscaper says, this vulnerability is not very easy to exploit, and it "can take upwards of 15 minutes for the bug to trigger."
"I guess a more determined attacker might be able to make it more reliable," the hacker said. "It is just an insanely small window in which we can win our race; I wasn't even sure if I could ever exploit it at all."
Internet Explorer 11 Sandbox Bypass
The second Microsoft zero-day vulnerability revealed today by SandboxEscaper affects Microsoft's web browser, Internet Explorer 11 (IE11).
Though the exploit note doesn't contain any detail about this flaw, a video demonstration released by the hacker shows the vulnerability exists due to an error when the vulnerable browser handles a maliciously crafted DLL file.
This would eventually allow an attacker to bypass IE Protected Mode sandbox and execute arbitrary code with Medium integrity permissions.
Though all three unpatched zero-day vulnerabilities SandboxEscaper released within last 24-hours are not critical, user can expect security updates from Microsoft on 11 June, the company's next month patch Tuesday.
SandboxEscaper has a history of releasing fully functional zero-day vulnerabilities in Windows operating system. Last August, she debuted another Windows Task Scheduler vulnerability on Twitter, which hackers quickly started exploiting in the wild in a spy campaign after disclosure.
Later in October, 2018, the hacker released an exploit for a then zero-day vulnerability in Microsoft's Data Sharing Service (dssvc.dll), which she dubbed "Deletebug." In December, 2018, she released two more zero-day vulnerabilities in Windows operating system.
You can expect two more Microsoft zero-day vulnerabilities from SandboxEscaper in the coming days, as she promised to release them.
Important Update — Two More 0-Day Exploited Published
Gal De Leon, Principal security researcher at Palo Alto Networks, in a Tweet revealed that the AngryPolarBearBug2 bug is not a zero day; instead, it has already been patched, identified as CVE-2019-0863, by Microsoft in May 2019 Patch Tuesday security updates.
However, SandboxEscaper has just released PoC exploits for two more new unpatched zero-day vulnerabilities in Microsoft Windows, making the zero-day disclosure to a total of 4 in the past 24 hours.
Out of 4, a new exploit bypasses the patch Microsoft released for an elevation of privilege vulnerability (CVE-2019-0841) in Windows that existed when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. pic.twitter.com/kgFhl8uBQy
— The Hacker News (@TheHackersNews) May 23, 2019
The first exploit bypasses the patch Microsoft released for an elevation of privilege vulnerability (CVE-2019-0841) in Windows that existed when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Another repository on GitHub has been labeled as a new "Installer Bypass" issue by SandboxEscaper.
Though the hacker has released video demonstration for both new flaws as well, security researchers have yet to confirm the claims.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2019/05/microsoft-zero-day-vulnerability.html