Tale of a Windows Error Reporting Zero-Day (CVE-2019-0863)
Summary: In December 2018 a researcher using the alias 'SandboxEscaper' publicly disclosed a zero-day in Windows Error Reporting, and while examining that submission Unit 42's researcher found a second zero-day that could elevate system privileges. Microsoft's advisory states the bug was exploited in the wild as a zero-day until a patch shipped in May 2019.
What's compelling: The flaw worked because the WER ReportQueue directory is writable by all users while the high-privilege wermgr.exe reads, parses, copies and deletes files there, letting an attacker use hard links and mount points to redirect a privileged process onto files like kernel32.dll and overwrite them with payload that later runs with System permissions.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-0863
- Related
- CVE-2019-0863: Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021