• It's a new day, and a new ZERO day for Windows

    From Big Bad Bombastic Bob@21:1/5 to All on Tue Nov 23 14:07:15 2021

    "In this case, a local privilege-elevation vulnerability to gain control
    of fully patched Windows 10, 11, and Server systems up to the 2022 build."

    according to the article, after getting the proof of concept code off of github, "We were able to fire up a shell running with SYSTEM privileges
    from a lowly standard user account."

    "one does need to be logged into a Windows box to elevate one's
    privileges, and it looks like Edge also needs to be installed"

    Naceri discovered the security hole while looking into Microsoft's fix
    for CVE-2021-41379, a vulnerability he had disclosed to the Windows
    giant previously. "The bug," he said, "was not fixed correctly."

    Looks like he did not give them any more time to get it right. heh.

    "While group policy by default doesn't allow standard users to do any
    MSI operation," Naceri said, "The administrative install feature thing
    seems to be completely bypassing group policy."

    that's right Microsoft: you cannot look the other way JUST BECAUSE IT
    IS DIFFICULT TO FIX. "We'll just do this much". Is that how it sounded?


    (aka 'Bombastic Bob' in case you wondered)

    'Feeling with my fingers, and thinking with my brain' - me

    'your story is so touching, but it sounds just like a lie'
    "Straighten up and fly right"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)