Security and Windows TCO: Patches and Privileges Broken

posted by Roy Schestowitz on Sep 13, 2024

• SEC Consule` ☛ Microsoft Windows MSI Installer - Repair to SYSTEM - A detailed journey - SEC Consult

  This article by our researcher Michael Baer for the SEC Consult Vulnerability Lab will explain different attacks against MSI installers and present an open-source analyzer tool named "msiscan" in order to automatically detect potential security issues. The main focus lies on an attack that abuses briefly opened command Windows during program execution of the MSI installer in the GUI. While most available public research on this topic tries to slow down the system in order to have enough time for the attack, we will describe a technique to completely pause the program execution. This simplifies the attack and makes it a lot more reliable.

• The Register UK ☛ More details on that Windows Installer 'make me admin' hole

  Essentially, a low privileged user opens an Installer package to repair some already-installed code on a vulnerable Windows system. The user does this by running an .msi file for a program, launching the Installer to handle it, and then selecting the option to repair the program (eg, like this). There is a brief opportunity to hijack that repair process, which runs with full SYSTEM rights, and gain those privileges, giving much more control over the PC.

• The Register UK ☛ Microsoft broke Windows 10 patching, fixes exploited bugs

  This is due to a programming error triggered by applying security updates released between March and August 2024 inclusively, we're told.

  It appears that if you install a security update issued between those two months on Windows 10 version 1507, and then apply updates or security patches released since March 12, the OS gets mighty confused and reverts the updated software back to its base RTM – release to manufacturing – version, leaving the code unpatched and the computer at risk of attack. According to Microsoft, this rollback can happen to the following optional components: [...]

• The Register UK ☛ 'Hadooken' Linux malware targets Oracle WebLogic servers [Ed: WebLogic is the issue here]