{"id":21910,"date":"2021-10-29T17:33:33","date_gmt":"2021-10-29T15:33:33","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=21910"},"modified":"2022-11-03T10:39:55","modified_gmt":"2022-11-03T09:39:55","slug":"local-privilege-escalation-schwachstelle-0-day-in-allen-windows-versionen","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2021\/10\/29\/local-privilege-escalation-schwachstelle-0-day-in-allen-windows-versionen\/","title":{"rendered":"Local Privilege Escalation Vulnerability (0-day) in all Windows Versions"},"content":{"rendered":"

\"Windows\"[German<\/a>]In all Windows versions, including Windows 11 and Windows Server 2022, there is an unpatched Local Privilege Escalation vulnerability. This should have been patched since August 2021, but the security update in question did not close the vulnerability completely. Fortunately, the damage is limited, as exploitability is not very easy. <\/p>\n

<\/p>\n

Windows vulnerability CVE-2021-34484<\/h2>\n

\"\"In August 2021, Microsoft published security advisory CVE-2021-34484<\/a> on a vulnerability in Windows User Profile Service. This vulnerability allows Local Privilege Escalation (LPE). However, details of the vulnerability reported by Abdelhamid Naceri (halov) – works for the Trend Micro Zero Day Initiative<\/a> – were not provided. At the same time, Microsoft has patched the vulnerabilities in the still-supported Windows versions via the August 2021 security updates.<\/p>\n

Patch bypassed<\/h2>\n

Security researcher Abdelhamid Naceri then looked into the matter after installing the security update and found that it did not fully close the LPE vulnerability. It was possible for him to bypass the security mechanism introduced by the Microsoft patch. Naceri points out the issue in the following tweet<\/a>. <\/p>\n

\"CVE-2021-34484<\/a><\/p>\n

He described the details on GitHub<\/a> and also submitted a proof of concept<\/a> (PoC). With the 0-day PoC, he can achieve SYSTEM permissions under certain conditions. Security researcher Will Dormann writes in a tweet<\/a> that the PoC works. <\/p>\n

\"CVE-2021-34484<\/a><\/p>\n

However, to exploit this PoC, an attacker would need to know a user's credentials. Therefore, the exploitability of the vulnerability should be low. The colleagues from Bleeping Computer have compiled some more information on the topic in this article<\/a>.  <\/p>\n","protected":false},"excerpt":{"rendered":"

[German]In all Windows versions, including Windows 11 and Windows Server 2022, there is an unpatched Local Privilege Escalation vulnerability. This should have been patched since August 2021, but the security update in question did not close the vulnerability completely. Fortunately, … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,2],"tags":[69,194],"class_list":["post-21910","post","type-post","status-publish","format-standard","hentry","category-security","category-windows","tag-security","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/21910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=21910"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/21910\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=21910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=21910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=21910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}