Windows ‘InstallerFileTakeOver’ Bug Micropatch Is Now Out

Share post:

An unofficial patch has been released for a zero-day vulnerability that is actively exploited to gain administrator privileges.

Proof-of-concept (PoC) exploit code that runs out of the box has been published for the current release, known as the “InstallerFileTakeOver” bug.

The vulnerability affects all versions of Windows and can be exploited by attackers with limited local accounts to escalate privileges and execute code with full admin privileges.

Abdelhamid Naceri, researcher and creator of the Poc, discovered the bug while analyzing the patch for another privilege escalation bug he reported to Microsoft and which is currently being tracked as CVE-2021-41379.

Naceri found that Microsoft’s fix was incomplete, allowing code to be executed with administrator privileges. He also explained that the new variant, which does not yet have a CVE identifier, “is more powerful than the original one.”

Mitja Kolsek, co-founder of the 0patch service, which offers hotfixes that do not require a reboot of the system, says that the error stems from the way the Windows installer creates a Rollback File (.RBF) that enables restoring the data that has been changed or deleted during the installation process.

The 0Patch code checks that there are no junctions or links in the destination path of the RBF file. Otherwise, it will block the movement of the file to eliminate the risk of exploitation.

The micropatch is free and works on Windows 7 ESU, Windows 10, Server 2008 ESU/2012/2016/2019, with a published video demonstrating what the micropatch does.

The 0Patch correcting code is a temporary solution with the aim of insulating systems until Microsoft provides a permanent patch for the problem, which has not yet happened.

At the moment, the best defense is to run the 0Patch temporary fix, which can be used without any need to restart the machine.

For more information, you may view the original story from Bleeping Computer.

Featured Tech Jobs


Related articles

Leaked documents may show the inside of China’s hacking strategy

Documents apparently stolen by disgruntled employees to embarrass their firm may give insight into China's cyber

Abuse of valid accounts by threat actors hits a high, says IBM

Attackers are finding that obtaining valid credentials is an easier route to achieving their goals, s

Cyber Security Today, Feb. 21, 2024 – A patch warning from ConnectWise, the latest ransomware news, and more

This episode reports on a report comparing business email compromise attacks against ransomware

UK leads takedown of LockBit ransomware gang’s website

The LockBit ransomware gang’s website has been seized, several news agencies reported late Monday. The Reuters news agency and The Register are carrying stories based on a new splash screen that has appeared on the gang’s website. It says, “This site is now under the control of the National Crime Agency of the UK, working

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways