There has been an ever-increasing number of vulnerabilities and malware rearing their ugly heads lately. One of the most common things these malware will attempt to do is gain elevated permissions to allow execution of its code without user interaction. Recently, a new vulnerability was found in the popular archival software 7-Zip that can potentially allow just that.
7-Zip is an open source universal compression and archive utility that is meant to work on Unix-like systems, and Windows. The exploit in question takes advantage of the fact that the Windows version of the software utilizes the system's help file format, known as CHM files. These help menu files can still utilize ActiveX controls, a functionality that saw its final release in 2013 and is today considered deprecated. ActiveX has been considered insecure for years by researchers due to its inherent elevated permissions, including direct access to executing shell commands as a privileged user.
When utilizing 7-Zip's help menu, it executes the hh.exe, which can still run and use ActiveX objects. If you attempt to drag a .7z extension file to that window that appears, after malware or an attacker has run their piece to unlock the nasty potential of elevated access, it can potentially open up a command prompt with elevated administrator access. This is displayed in the video made by Kağan Çapar, a security researcher from Turkey.
Kağan does state in his GitHub, which outlines the vulnerability, that he will not publish the details of the exploit until after the issue is patched by the 7-Zip developers. No action has been taken yet, unfortunately. He does, however, go on to say that the bug report has been issued to 7-Zip developers, and that its CVE-2022-29072 designation has been submitted to security reporting web sites.
Screenshot of 7-Zip Bug Report
Of course, the researcher also outlines probably the simplest way to prevent an issue. Just delete the CHM file from your installation of 7-Zip. This will prevent the help menu from opening and just cause any attempts at this to fail. You can also modify what permissions the hh.exe process can operate at, but for most users just deleting the .chm file from the installation directory is easiest.
By Bill Toulas, Bleeping Computer Ukraine's computer emergency response team (CERT-UA) has published an announcement warning of ongoing DDoS (distributed denial of service) attacks targeting pro-Ukraine sites and the government web portal. The threat actors, who at this time remain unknown, are compromising WordPress sites and injecting malicious JavaScript code to perform the attacks. These scripts are placed in the HTML structure of the main files of the website and are base64-encoded to evade detection. The code runs on the website visitor's computer and directs their available computational resources to generate an abnormal number of requests to attack objects (URLs) defined in the code. The result is that some of the target websites are overwhelmed by the requests and, as a result, rendered inaccessible to their regular visitors. This all happens without the owners or the visitors of the compromised sites ever realizing it, except for maybe some barely noticeable performan...
By Lawrence Abrams, Bleeping Computer A recent security update for a Windows NTLM Relay Attack has been confirmed to be a previously unfixed vector for the PetitPotam attack. During the May 2022 Patch Tuesday, Microsoft released a security update for an actively exploited NTLM Relay Attack labeled as a 'Windows LSA Spoofing Vulnerability' and tracked as CVE-2022-26925 . "An unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. This security update detects anonymous connection attempts in LSARPC and disallows it." An NTLM Relay Attack allows threat actors to force devices, even domain controllers, to authenticate against malicious servers they control. Once a device authenticates, the malicious server can impersonate the device and gain all of its privileges. These attacks are significant problems as they could allow a threat actor to gain complete control over the domain. Whi...
By Sergiu Gatlan, Bleeping Computer Microsoft has mitigated an Azure outage that lasted more than two hours and took down multiple services for customers across North and Latin America. The company says the incident started around 18:22 UTC and impacted services that leverage Azure Front Door (AFD), its modern cloud Content Delivery Network (CDN). "This issue is impacting multiple geographies, mostly in North America and Latin America," Redmond explained when it first acknowledged the outage on the Azure status page, saying it was caused by what it described as a "configuration change." "We have rolled back this change and, from 19:25 UTC, the majority of services are seeing recovery. Many Microsoft services have failed away from AFD, in response to this issue." However, customers have also reported experiencing errors connecting to Azure services (including Azure DevOps) in the United Kingdom, with the Azure DevOps status page also tagging the issues ...
Comments
Post a Comment