Windows Installer Zero-day Vulnerability Gets Free Micropatch

A vulnerability in the Windows Installer component, which Microsoft attempted to fix several times to no avail, today received a micropatch to deny hackers the option of gaining the highest privileges on a compromised system.

The issue affects Windows 7 through 10. Microsoft’s most recent effort to address the issue (CVE-2020-16902) was in October. A bypass, complete with proof-of-concept (PoC) exploit code emerged in late December 2020.

Patch, bypass, repeat

During the installation of an MSI package, Windows Installer creates a rollback script via ‘msiexec.exe’ to revert any changes if anything goes wrong in the process.

A hacker with local privileges could run an executable with SYSTEM permissions if they could replace the rollback script with one that changes a registry value to point to their payload.

Also Read: 15 Best Tools For Your Windows 10 Privacy Settings Setup

The vulnerability popped on Microsoft’s radar and received a fix in April 2019 (CVE-2019-0841). Vulnerability researcher Sandbox Escaper found a bypass by the end of May and published some technical details.

The story repeated four more times (CVE-2019-1415, CVE-2020-1302, CVE-2020-0814, CVE-2020-16902), and Windows Installer is still exploitable for privilege escalation to the highest permissions on a compromised machine.

The latest bypass has been disclosed by security researcher Abdelhamid Naceri on his blog along with other vulnerabilities affecting multiple security software solutions.

Temporary fix available

Mitja Kolsek, CEO of ACROS Security and co-founder of the 0patch micropatching service, explains how Naceri’s PoC for the vulnerability (no tracking number) works:

“The proof-of-concept is using a rollback script that changes the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Fax\ImagePath to c:\Windows\temp\asmae.exe, which results in the Fax Service using attacker’s asmae.exe when the service is launched. This service was used because any user is allowed to launch it, and it’s running as Local System” – Mitja Kolsek

Until Microsoft comes up with a permanent patch, a temporary one is available through the 0Patch platform. It is a single-instruction fix that does not require a reboot of the system.

The video below shows that the micropatch prevents a local non-admin user from modifying a registry value that points to the Fax Service executable, which would lead to running attacker code.

Also Read: Going Beyond DPO Meaning: Ever Heard of Outsourced DPO?

The temporary, free fix from 0Patch works for the following systems:

• Windows 10 v20H2, 32/64bit, updated with January 2021 updates
• Windows 10 v2004, 32/64bit, updated with January 2021 updates
• Windows 10 v1909, 32/64bit, updated with January 2021 updates
• Windows 7, 32/64bit, with ESU, updated with January 2021 updates
• Windows 7, 32/64bit, without ESU, updated with January 2020 updates