ESET unearths Windows exploit used in highly targeted attack
The Windows win32k.sys vulnerability uses the pop-up menu for deployment
A 0-day exploit that used a local privilege escalation vulnerability in Microsoft Windows has been unmasked.
The exploit has been deployed in a highly targeted attack in Eastern Europe, according to researchers at ESET who discovered and analysed the threat.
The exploit only has impact on limited versions of Windows, because in Windows 8 and later versions, a user process is not allowed to map the NULL page, which is required for the attack in question to be launched and successful.
This specific Windows win32k.sys vulnerability, like others, uses the pop-up menu for deployment. “For example, the Sednit group’s local privilege escalation exploit we analysed in 2017 used menu objects and exploitation techniques, which are very similar to the current exploit,” explained ESET Researcher Anton Cherepanov, who discovered the latest exploit.
The vulnerability (CVE-2019-1132) affects: Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-Based Systems Service Pack 1; Windows Server 2008 for 32-bit Systems Service Pack 2; Windows Server 2008 for Itanium-Based Systems Service Pack 2; Windows Server 2008 for x64-Based Systems Service Pack 2; Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1; and Windows Server 2008 R2 for x64-Based Systems Service Pack 1. Windows XP and Windows Server 2003 are also affected, but these versions are not supported by Microsoft.
“Users who still use Windows 7 Service Pack 1 should consider updating to fresh operating systems, since extended support of Windows 7 Service Pack 1 is going to end on January 14, 2020. Which means that Windows 7 users won’t receive critical security updates,” Cherepanov added.
Microsoft has since released a patch for the exploit.