Security researcher accidentally discovers Windows 7 and Windows Server 2008 zero-day
Summary
The vulnerability resides in two misconfigured registry keys for the RPC Endpoint Mapper and DNSCache services that are part of all Windows installations. French security researcher Clément Labro, who discovered the zero-day, says that an attacker that has a foothold on vulnerable systems can modify these registry keys to activate a sub-key usually employed by the Windows Performance Monitoring mechanism. Labro said he discovered the zero-day after he released an update to PrivescCheck, a tool to check common Windows security misconfigurations that can be abused by malware for privilege escalation. Labro said he didnt know the new checks were highlighting a new and unpatched privilege escalation method until he began investigating a series of alerts appearing on older systems like Windows 7, days after the release. The micro-patch is installed via the companys 0patch security software and prevents malicious actors from exploiting the bug through ACROS unofficial patch.
Classifications
AskAI Classifications
LabelsLinked Companies
