December 2018: Further Zero Day Vulnerabilities Disclosed

=======================
Update: 6th February 2019
=======================
In mid-January; the security firm 0patch issued a micropatch for what I refer to as vulnerability 4 (discussed below). As before the patch can be applied and will protect your devices until Microsoft can issue a finalised update via the regular channels.

The patch is only available for Windows 10 Version 1803. 0patch have requested that you contact them if you wish to obtain a patch for another version of Windows 10. They have published a YouTube video of the patch preventing the proof of concept code from working as the attacker intended.

Approximately a week after this micropatch was issued; another micropatch was made available; this time for what I refer to as vulnerability 3 (discussed below). That patch is available for Windows 10 Version 1803 64 bit and Windows 7 bit. As before 0patch have requested that you contact them if you wish to obtain a patch for another version of Windows. Another YouTube video is available demonstrating the micropatch preventing the proof of concept code from reading any file on the system as the attacker intended. It does this by changing the permissions on the temporary MSI file created by Windows Installer. The micropatch was more complex than originally thought to create. 0patch wanted to issue their patch before the Holiday period in December but were unable to do so since it required more thorough testing before being made available but there was not enough time left for that testing.

The micropatch does not require a reboot. As before the patch does not need to be uninstalled once you later install the update from Microsoft.

At this time, it is assumed that Microsoft will issue a patch for these vulnerabilities in February but they may be more complex (similar to the previous JET vulnerability) and require further time to refine the fixes.

Thank you.

=======================
Original Post:
=======================
In the 3rd week of December; a security researcher using the name SandboxEscaper (who we have discussed twice before on this blog) announced a 3rd zero-day (defined) vulnerability followed by a 4th on the 30th of December.

For the 3rd vulnerability: Windows 7 and Windows 10 are confirmed as impacted. Windows 8.1 may also be vulnerable. For the 4th vulnerability; Windows 10 Version 1803 (Build 17134) has been confirmed as impacted (it’s unknown if newer builds of Window 10 or if Windows 7/8.1 are vulnerable).

How severe are these vulnerabilities and what is their impact?
I’ll break these into 2 sections:

=======================
Vulnerability 3:
Arbitrary file read issue: Uses MsiAdvertiseProduct:
=======================
From the limited information available this vulnerability does not appear to be remotely exploitable. The attacker would already need to have compromised an account on your Windows system in order to run the necessary proof of concept code. This vulnerability should be considered medium but not critical severity. When exploited it can allow an attacker to read/copy any files they choose using the permissions from the Windows Installer Service namely LocalSystem privileges (the highest level of privilege)(defined). The vulnerability makes use of a time to check to time to use (TOCTOU) race condition type.

In the same manner as the previous vulnerabilities it may be leveraged in the wild before it is patched by Microsoft; this is my reason for advising exercising caution with email and clicking unexpected links (within emails, links within IM clients or social networks). Security researcher Will Dormann found this exploit inconsistent when used. Meanwhile Acros Security CEO Mitja Kolsek stated It was very likely a micropatch for this exploit would be available before the holiday period.

=======================
Vulnerability 4:
Arbitrary file overwrite issue: Proof of concept overwrites pci.sys
=======================
As above; this vulnerability does not appear to be remotely exploitable. The attacker would already need to have compromised an account on your Windows system in order to run the necessary proof of concept code. This vulnerability should be considered medium but not critical severity. When exploited it can allow an attacker to overwrite pci.sys with information about software and hardware problems, collected through the Windows Error Reporting (WER) but the attacker can also influence what data is used to overwrite the original file. The vulnerability again makes use of a race condition which means that the exploit doesn’t always provide the attacker with the intended result. This is especially true for systems with a single CPU core.

However; the choice of pci.sys for the proof of concept was an example; any file could be used (confirmed by Will Dormann).

How can I protect my organization/myself from these vulnerabilities?
The same advice issued for the first two zero day disclosures again applies here. This US-CERT advisory also provides advice for safely handling emails.

If you wish to deploy the micropatch from the firm 0patch; please test how well it works in your environment thoroughly BEFORE deployment in your production environment.

It can be obtained by installing and registering 0patch Agent from https://0patch.com Such micropatches usually install and need no further action when Microsoft officially patches the vulnerability since the micropatch is only active when a vulnerable version of the affected file is used; once patched the micropatch has no further effect (it is then unnecessary).

Thank you.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.