Actively Exploited Windows Zero-Day Gets a Patch

Reading Time: 2 Minutes

See Also: Auth Bypass Bug Exploited, Affecting Millions of Routers

The bug tracked as CVE-2021-26424 exists in the TCP/IP protocol stack identified in Windows 7 and newer Microsoft operating systems, including servers.

“Despite its CVSS rating of 9.9, this may prove to be a trivial bug, but it’s still fascinating,” said Dustin Childs of Trend Micro’s Zero Day Initiative (ZDI) in his Tuesday analysis. “An attacker on a guest Hyper-V OS could execute code on the host Hyper-V server by sending a specially crafted IPv6 ping. This keeps it out of the wormable category. Still, a successful attack would allow the guest OS to completely take over the Hyper-V host. While not wormable, it’s still cool to see new bugs in new scenarios being found in protocols that have been around for years.”

The next bug, CVE-2021-26432 in Windows Services, is more likely to be exploited given its low complexity status, according to Microsoft’s advisory; it doesn’t require privileges or user interaction to exploit, but Microsoft offered no further details.

“This may fall into the ‘wormable’ category, at least between servers with NFS installed, especially since the open network computing remote procedure call (ONCRPC) consists of an External Data Representation (XDR) runtime built on the Winsock Kernel (WSK) interface,” Childs said. “That certainly sounds like elevated code on a listening network service. Don’t ignore this patch.”

Aleks Haugom, product marketing manager at Automox, added, “Exploitation results in total loss of confidentiality across all devices managed by the same security authority. Furthermore, attackers can utilize it for denial-of-service attacks or to maliciously modify files. So far, no further details have been divulged by Microsoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi’anxin Group) that discovered this vulnerability. Given the broad potential impact, its label ‘Exploitation More Likely’ and apparent secrecy, patching should be completed ASAP.”

Meanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.

“CVE-2021-34480 should also be a priority,” Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. “It is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as ‘Exploitation More Likely’ because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.  Simple, but effective.”

See Also: Offensive Security Tool: Mimikatz

See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker

RCE Zero-Day in Windows Update Medic Service

The actively exploited bug is tracked as CVE-2021-36948 and is rated as important; it could pave the way for RCE via the Windows Update Medic Service in Windows 10 and Server 2019 and newer operating systems.

“Update Medic is a new service that allows users to repair Windows Update components from a damaged state such that the device can continue to receive updates,” Automox’ Jay Goodman explained. “The exploit is both low complexity and can be exploited without user interaction, making this an easy vulnerability to include in an adversary’s toolbox.”

Immersive’s Breen added, “CVE-2021-36948 is a privilege-escalation vulnerability – the cornerstone of modern intrusions as they allow attackers the level of access to do things like hide their tracks and create user accounts.  In the case of ransomware attacks, they have also been used to ensure maximum damage.”

Though the bug is being reported as being exploited in the wild by Microsoft, activity appears to remain limited or targeted: “We have seen no evidence of it at Kenna Security at this time,” Jerry Gamblin, director of security research at Kenna Security (now part of Cisco) told Threatpost.

Publicly Known Windows LSA Spoofing Bug

The second publicly known bug (after the Print Spooler issue covered earlier) is tracked as CVE-2021-36942, and it’s an important-rated Windows LSA (Local Security Authority) spoofing vulnerability.

“It fixes a flaw that could be used to steal NTLM hashes from a domain controller or other vulnerable host,” Immersive’s Breen said. “These types of attacks are well known for lateral movement and privilege escalation, as has been demonstrated recently by a new exploit called PetitPotam. It is a post-intrusion exploit – further down the attack chain – but still a useful tool for attackers.”

Childs offered a bit of context around the bug.

“Microsoft released this patch to further protect against NTLM relay attacks by issuing this update to block the LSARPC interface,” he said. “This will impact some systems, notably Windows Server 2008 SP2, that use the EFS API OpenEncryptedFileRawA function. You should apply this to your Domain Controllers first and follow the additional guidance in ADV210003 and KB5005413. This has been an ongoing issue since 2009, and, likely, this isn’t the last we’ll hear of this persistent issue.”

Microsoft’s next Patch Tuesday will fall on September 14.

Source: threatpost.com

(Click Link)