Microsoft Investigating Windows Proof-of-Concept Flaw

Microsoft noted last week that its security team is looking into an elevation-of-privilege exploit affecting Windows-based systems.

The company released very little information, except for a brief Nov. 24 notice on its Twitter security response page. The flaw was disclosed after someone posted proof-of-concept code on a "programming education site," according to Chester Wisniewski, senior security advisor at Sophos Canada, in a blog post. The code was subsequently removed, he noted.

The flaw enables elevation-of-privilege from a local user account level to the system account level. It also bypasses the user account control (UAC) protection found in Windows Vista and Windows 7, Wisniewski explained. He described it as a Win32k.sys bug.

"The flaw is related to the way in which a certain registry key is interpreted and enables an attacker to impersonate the system account, which has nearly unlimited access to all components of the Windows system," he wrote in the blog.

In addition to Vista and Windows 7, other Windows operating systems (both 32-bit and 64-bit) are subject to the flaw, including Windows XP, Windows Server 2008 and Windows Server 2003, according to a post by Prevx blogger Marco Giuliani. He explained that the flaw cannot be exploited via remote code execution.

"It is a local privilege escalation exploit," Giuliani wrote. "This means that the potential malware must be already in the target machine to exploit this flaw." However, he described it as a critical flaw because it enables the local user to gain administrative privileges.

Microsoft hasn't rated the exploit nor said when, or if, it would provide a fix. Both antimalware vendors offered some advice in their blogs to avoid the zero-day flaw. The advice includes altering the registry for standard users or downloading security software.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

  • A top-down view of a person walking through a maze with walls made of glowing blue Wi-Fi symbols on dark pathways

    Navigating New E-Rate Rules for WiFi Hotspots

    Beginning in funding year 2025, WiFi hotspots will be eligible for E-rate Category One discounts. Here's what you need to know about your school's eligibility, funding caps, tracking requirements, and more.

  • glowing digital lock surrounded by futuristic dollar signs, stacks of currency, and coins, connected by neon circuit lines

    FCC Reports Strong Interest in Schools and Libraries Cybersecurity Pilot Program

    The Federal Communications Commission has received 2,734 applications totaling $3.7 billion in funding requests from schools, libraries, and consortia for its Schools and Libraries Cybersecurity Pilot Program, the agency reported in a recent announcement.

  • zSpace Imagine Learning Solution

    zSpace Debuts Headset-Free AR/VR System

    Immersive learning company zSpace has announced the zSpace Imagine Learning Solution, a headset-free AR/VR laptop system designed for elementary education. The all-in-one platform integrates hardware, software, and hands-on lessons to create dynamic learning experiences for young students.

  • magnifying glass hovers high above a tablet, showing a zoomed-in view of binary code and digital circuits

    Evidence in Ed Tech: A Matter of Importance

    When evaluating which ed tech tools to adopt, evidence of impact is one of the most important factors to consider.