{"id":3555,"date":"2021-11-24T16:40:06","date_gmt":"2021-11-24T15:40:06","guid":{"rendered":"https:\/\/sajberinfo.com\/2022\/11\/21\/text-96\/"},"modified":"2022-12-04T13:41:16","modified_gmt":"2022-12-04T12:41:16","slug":"windows-zero-day-cve-2021-41379","status":"publish","type":"post","link":"http:\/\/sajberinfo.com\/en\/2021\/11\/24\/windows-zero-day-cve-2021-41379\/","title":{"rendered":"Windows zero-day: CVE-2021-41379"},"content":{"rendered":"

Sigurnosni istra\u017eiva\u010d Abdelhamid Naceri<\/em> je otkrio ranjivost u operativnom sistemu Windows<\/em> koja napada\u010du mo\u017ee omogu\u0107iti da kori\u0161tenjem obi\u010dnog korisni\u010dkog naloga, preko Microsoft Windows Installer<\/em>-a dobije administratorske privilegije. Ranjivost se odnosi na sve verzije operativnog sistema Windows<\/em> uklju\u010duju\u0107i i potpuno a\u017eurirane verzije Windows 11<\/em> i Server 2022<\/em>.<\/span><\/span><\/p>\n

\"Windows

Windows ranjivost<\/p><\/div>\n

Sigurnosni istra\u017eiva\u010d je sara\u0111ivao sa kompanijom Microsoft<\/em> koja je izdala a\u017euriranje 9. novembra, konkretno adresirano na sistemsku ranjivost CVE-2021-41379<\/a><\/em>. Ipak, ovo a\u017euriranje nije u potpunosti rije\u0161ilo problem, pa je on odlu\u010dio da objavi proof-of-concept<\/em> <\/a>na GitHub<\/em>-u koji je na\u017ealost potpuno funkcionalan uprkos sistemskom a\u017euriranju od strane proizvo\u0111a\u010da. Kompanija Microsoft<\/em> je ovu ranjivost ozna\u010dila sa vrijedno\u0161\u0107u CVSS 5.5<\/em>, ali objavljivanje koncepta \u0107e sigurno dodatno pove\u0107ati njenu zloupotrebu. Iz sigurnosnog tima Cisco Talos Intelligence Group<\/em> ve\u0107 je stigla potvrda da su otkrili uzorke zlonamjernog softvera koji iskori\u0161tava ovu ranjivosti. <\/span><\/span>\u00a0<\/span><\/span><\/p>\n

Trenutno nema zaobilaznih rije\u0161ena, tvrdi sigurnosni istra\u017eiva\u010d Abdelhamid Naceri<\/em>, a s obzirom da ranjivost iskori\u0161tava postoje\u0107u MSI<\/em> funkcionalnost tako ne\u0161to je te\u0161ko i primijeniti. Dobra vijest je da napada\u010d mora imati lokalni pristup ure\u0111aju da bi iskoristio ovu ranjivost. Organizacije za sada mogu iskoristi Snort rules<\/a><\/em> koje je objavio Cisco Talos Intelligence Group<\/em>.<\/span><\/span>\u00a0<\/span><\/span><\/p>\n

O\u010dekuje se da \u0107e kompanija Microsoft <\/em>izdati a\u017euriranje za ovu ranjivost u sljede\u0107em redovnom ciklusu a\u017euriranja. Pored toga, tu je preporuka i sigurnosnog istra\u017eiva\u010da da se ne primjenjuju mikro a\u017euriranja drugih kompanija, zbog kompleksnosti ove ranjivost. U protivnom bi moglo do\u0107i do prestanka funkcionisanja Windows Installer<\/em>-a.<\/span><\/span><\/div>\n","protected":false},"excerpt":{"rendered":"

Sigurnosni istra\u017eiva\u010d Abdelhamid Naceri je otkrio ranjivost u operativnom sistemu Windows koja napada\u010du mo\u017ee omogu\u0107iti da kori\u0161tenjem obi\u010dnog korisni\u010dkog naloga, preko Microsoft Windows Installer-a dobije administratorske privilegije. Ranjivost se odnosi na sve verzije operativnog...<\/p>","protected":false},"author":1,"featured_media":3672,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[123,130,122,125,126,143,120,168],"class_list":["post-3555","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hronike","tag-github","tag-microsoft","tag-poc","tag-proof-of-concept","tag-vulnerability","tag-windows","tag-windows-11","tag-windows-server-2022"],"_links":{"self":[{"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/3555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/comments?post=3555"}],"version-history":[{"count":0,"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/3555\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media\/3672"}],"wp:attachment":[{"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media?parent=3555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/categories?post=3555"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/tags?post=3555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}