AMD fixes dozens of Windows 10 graphics driver security bugs
Void Balaur hackers-for-hire sell stolen mailboxes and private data
Russian ‘King of Fraud’ sentenced to 10 years for Methbot scheme
Windows 10 App Installer abused in BazarLoader malware attacks
The Week in Ransomware – November 12th 2021 – Targeting REvil
Microsoft Intune bug forces Samsung devices into non-compliant state
QBot returns for a new wave of infections using Squirrelwaffle
FTC shares ransomware defense tips for small US businesses
Qualys BrowserCheck
Junkware Removal Tool
How to remove the PBlock+ adware browser extension
Remove the Search Redirect
Remove the Search Redirect
Remove the Search Redirect
Remove Security Tool and SecurityTool (Uninstall Guide)
How to remove Antivirus 2009 (Uninstall Instructions)
How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller
Locky Ransomware Information, Help Guide, and FAQ
CryptoLocker Ransomware Information Guide and FAQ
CryptorBit and HowDecrypt Information Guide and FAQ
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
How to make the Start menu full screen in Windows 10
How to install the Microsoft Visual C++ 2015 Runtime
How to open an elevated PowerShell Admin prompt in Windows 10
How to Translate a Web Page in Google Chrome
How to start Windows in Safe Mode
How to remove a Trojan, Virus, Worm, or other Malware
How to show hidden files in Windows 7
How to see hidden files in Windows
IT Certification Courses
Gear + Gadgets
Zero-day bug in all Windows versions gets free unofficial patch
A free and unofficial patch is now available for a zero-day local privilege escalation vulnerability in the Windows User Profile Service that lets attackers gain SYSTEM privileges under certain conditions.
The bug, tracked as CVE-2021-34484, was incompletely patched by Microsoft during the August Patch Tuesday. The company only addressed the impact of the proof-of-concept (PoC) provided by security researcher Abdelhamid Naceri who reported the issue.
Naceri later discovered that threat actors could still bypass the Microsoft patch to elevate privileges to gain SYSTEM privileges if certain conditions are met, getting an elevated command prompt while the User Account Control (UAC) prompt is displayed.
CERT/CC vulnerability analyst Will Dormann tested the CVE-2021-34484 bypass PoC exploit and found that, while it worked, it would not always create the elevated command prompt. However, in BleepingComputer’s tests, it launched an elevated command prompt immediately, as shown below.
Luckily, the exploit requires attackers to know and log in with other users’ credentials for exploiting the vulnerability, which means that it will likely not be as widely abused as other LPE bugs (including PrintNightmare).
The bad news is that it impacts all Windows versions, including Windows 10, Windows 11, and Windows Server 2022, even if fully patched.
Additionally, the researcher told BleepingComputer threat actors will only need another domain account to deploy the exploits in attacks, so it’s definitely something admins should be concerned about.
After BleepingComputer’s report on the CVE-2021-34484 bypass, Microsoft told us that they are aware of the issue and “will take appropriate action to keep customers protected.”
While Microsoft is still working on a security update to address this zero-day flaw, the 0patch micropatching service has released Thursday a free unofficial patch (known as a micropatch).
0patch developed the micropatch using the info provided by Naceri in his write-up and PoC for the Windows User Profile Service 0day LPE.
You can apply this free patch to block attacks using the CVE-2021-34484 bypass on the following Windows versions:
“While this vulnerability already has its CVE ID (CVE-2021-33742), we’re considering it to be without an official vendor fix and therefore a 0day,” 0patch co-founder Mitja Kolsek explained. “Micropatches for this vulnerability will be free until Microsoft has issued an official fix.”
To install this unofficial patch on your system, you will first need to register a 0patch account and then install the 0patch agent.
Once you launch the agent, the micropatch is applied automatically (if there is no custom patching enterprise policy in place blocking it), without the need to reboot the device.
While this issue in theory also impacts older Windows versions, Kolsek said that “the vulnerable code is different there, making the window for winning the race condition extremely narrow and probably unexploitable.”
A video demo of the CVE-2021-33742 micropatch in action is embedded below.
Chinese hackers use Windows zero-day to attack defense, IT firms
Microsoft fixes critical bugs in secretly installed Azure Linux app
Millions of HP OMEN gaming PCs impacted by driver vulnerability
Android November patch fixes actively exploited kernel bug
All Windows versions impacted by new LPE zero-day vulnerability
0patch is great.
Not a member yet? Register Now
Costco discloses data breach after finding credit card skimmer
Microsoft: New security updates trigger Windows Server auth issues
To receive periodic updates and news from BleepingComputer, please use the form below.
Terms of Use Privacy PolicyEthics Statement
Copyright @ 2003 – 2021 Bleeping Computer® LLC – All Rights Reserved
Not a member yet? Register Now
Read our posting guidelinese to learn what content is prohibited.


You May Also Like

Emotet now drops Cobalt Strike, fast forwards ransomware attacks

Emotet now drops Cobalt Strike, fast forwards ransomware attacksSonicWall ‘strongly urges’ customers…

Microsoft previews new endpoint security solution for SMBs

ALPHV BlackCat – This year’s most sophisticated ransomwareSonicWall ‘strongly urges’ customers to…

Beware: Free Discord Nitro phishing targets Steam gamers

CISA orders federal agencies to fix hundreds of exploited security flawsUS sanctions…

New Windows 11 build fixes Microsoft Installer issue breaking apps

Microsoft: Office 365 will boost default protection for all usersMicrosoft increases Windows…