{"id":19804,"date":"2021-05-07T00:10:00","date_gmt":"2021-05-06T22:10:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=19804"},"modified":"2022-06-27T09:19:41","modified_gmt":"2022-06-27T07:19:41","slug":"0patch-fixt-windows-installer-lpe-bug-cve-2021-26415","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2021\/05\/07\/0patch-fixt-windows-installer-lpe-bug-cve-2021-26415\/","title":{"rendered":"0patch fixes Windows Installer LPE-Bug (CVE-2021-26415)"},"content":{"rendered":"

[German<\/a>]ACROS Security has released a micropatch for the CVE-2021-26415 vulnerability in Windows Installer. This vulnerability was patched by Microsoft in April 2021 via a security update. The 0patch solution is for people who do not have an ESU license.<\/p>\n

<\/p>\n

The vulnerability CVE-2021-26415<\/h2>\n

Vulnerability CVE-2021-26415<\/a> is a vulnerability in Windows Installer that allows Elevation of Privilege on Windows. This vulnerability allows local attackers to write data to arbitrary files on affected installations of Microsoft Windows. An attacker must first gain the ability to execute low-privilege code on the target system to exploit this vulnerability. <\/p>\n

The specific flaw exists within the Windows Installer service. The issue results from the lack of proper validation of a user-supplied path before it is used in file operations. An attacker can exploit this vulnerability to escalate privileges and execute arbitrary code in the context of an administrator. The vulnerability is a classic symbolic link issue where a privileged process (in this case msiexec.exe) operates on a file (in this case the installer log file) that the attacker can \"redirect\" to another location where they do not have privileges to create or modify files.<\/p>\n

Microsoft has released security updates for Windows Server 2008 R2 through Windows Server 2004 and 20H2 as of April 13, 2021. However, Windows Server 2008 R2 systems will only receive this security update if a valid ESU license is in place. On April 21, security researcher Adrian Denkiewicz published a detailed analysis<\/a> of the local privilege escalation vulnerability in Windows Installer, which was fixed in the April 2021 Windows Updates. Adrian's analysis included a proof-of-concept.  <\/p>\n

0patch Micropatch for Windows 7\/Server 2008 R2<\/h2>\n

Mitja Kolsek of ACROS Security points out in the following tweet<\/a> that there is a micropatch for the vulnerability in Windows Installer for Windows 7 SP1 and Windows Server 2008 R2. <\/p>\n

\"0Patch<\/a> <\/p>\n

The micropatch is available for systems running Windows 7 SP1 and Windows Server 2008 R2 that do not have Extended Security Update support (ESU) from Microsoft, but have an opatch Pro subscription (for 23 Euro+VAT\/year) – see also this blog post<\/a>. Notes on how the 0patch agent works, which loads the micropatches into memory at runtime of an application, can be found in the blog posts (like here<\/a>). <\/p>\n

Similar articles:
<\/strong>Windows 7: Forcing February 2020 Security Updates<\/a> \u2013 Part 1
Windows 7: Securing with the 0patch solution<\/a> \u2013 Part 2
0patch supports Office 2010 with micro patches after the end of support (EOL)<\/a>
Windows 7\/Server 2008\/R2: 0patch delivers security patches after support ends<\/a>
Project: Windows 7\/Server 2008\/R2 Life Extension & 0patch one month trial<\/a>
0patch: Fix for Internet Explorer 0-day vulnerability CVE-2020-0674<\/a>
0patch: Fix for Windows Installer flaw CVE-2020-0683<\/a>
0patch fix for Windows GDI+ vulnerability CVE-2020-0881<\/a>
0-day vulnerability in Windows Adobe Type Library<\/a>
0patch fixes CVE-2020-0687 in Windows 7\/Server 2008 R2<\/a>
0patch fixes CVE-2020-1048 in Windows 7\/Server 2008 R2<\/a>
0patch fixes CVE-2020-1015 in Windows 7\/Server 2008 R2<\/a>
0patch for 0-day RCE vulnerability in Zoom for Windows<\/a>
Windows Server 2008 R2: 0patch fixes SIGRed vulnerability<\/a>
0patch fixes CVE-2020-1113 in Windows 7\/Server 2008 R2<\/a>
0patch fixes CVE-2020-1337 in Windows 7\/Server 2008 R2<\/a>
0patch fixes CVE-2020-1530 in Windows 7\/Server 2008 R2<\/a>
0patch fixes Zerologon (CVE-2020-1472) vulnerability in Windows Server 2008 R2<\/a>
0patch fixes CVE-2020-1062 in Windows 7\/Server 2008 R2<\/a>
0patch fixes CVE-2020-1300 in Windows 7\/Server 2008 R2<\/a>
0patch fixes 0-day vulnerability in Windows 7\/Server 2008 R2<\/a>
0patch fixes CVE-2020-1013 in Windows 7\/Server 2008 R2<\/a>
0patch fixes a Local Privilege Escalation 0-day in Sysinternals PsExec<\/a>
0patch fixes Windows Installer 0-day Local Privilege Escalation vulnerability<\/a>
0patch fixes 0-day in Internet Explorer<\/a>
0patch fixes CVE-2021-26877 in the DNS server of Windows Server 2008 R2<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[German]ACROS Security has released a micropatch for the CVE-2021-26415 vulnerability in Windows Installer. This vulnerability was patched by Microsoft in April 2021 via a security update. The 0patch solution is for people who do not have an ESU license.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,2],"tags":[69,17,18],"class_list":["post-19804","post","type-post","status-publish","format-standard","hentry","category-security","category-windows","tag-security","tag-windows-7","tag-windows-server-2008-r2"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/19804","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=19804"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/19804\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=19804"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=19804"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=19804"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}