Windows ‘InstallerFileTakeOver’ Bug Micropatch Is Now Out

Share post:

An unofficial patch has been released for a zero-day vulnerability that is actively exploited to gain administrator privileges.

Proof-of-concept (PoC) exploit code that runs out of the box has been published for the current release, known as the “InstallerFileTakeOver” bug.

The vulnerability affects all versions of Windows and can be exploited by attackers with limited local accounts to escalate privileges and execute code with full admin privileges.

Abdelhamid Naceri, researcher and creator of the Poc, discovered the bug while analyzing the patch for another privilege escalation bug he reported to Microsoft and which is currently being tracked as CVE-2021-41379.

Naceri found that Microsoft’s fix was incomplete, allowing code to be executed with administrator privileges. He also explained that the new variant, which does not yet have a CVE identifier, “is more powerful than the original one.”

Mitja Kolsek, co-founder of the 0patch service, which offers hotfixes that do not require a reboot of the system, says that the error stems from the way the Windows installer creates a Rollback File (.RBF) that enables restoring the data that has been changed or deleted during the installation process.

The 0Patch code checks that there are no junctions or links in the destination path of the RBF file. Otherwise, it will block the movement of the file to eliminate the risk of exploitation.

The micropatch is free and works on Windows 7 ESU, Windows 10, Server 2008 ESU/2012/2016/2019, with a published video demonstrating what the micropatch does.

The 0Patch correcting code is a temporary solution with the aim of insulating systems until Microsoft provides a permanent patch for the problem, which has not yet happened.

At the moment, the best defense is to run the 0Patch temporary fix, which can be used without any need to restart the machine.

For more information, you may view the original story from Bleeping Computer.


Related articles

Security research team claims to have helped avert a major supply chain attack

JFrog Security Research team continuously scans public repositories such as Docker Hub, NPM, and PyPI to identify malicious...

Phishing attacks on state and local governments surge by 360%

Phishing attacks targeting state and local governments have surged by 360% between May 2023 and May 2024, according...

What is Ticketmaster saying to its customers?

Here's the letter that has been sent out out to Ticketmaster clients that a reader sent to me....

Cyber Security Today, July 8, 2024 – New ransomware group discovered, and summer podcast break starts

A new ransomware group is discovered. Welcome to Cyber Security Today. It's Monday July 8th, 2024. I'm Howard Solomon,...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways