Windows 0day allows malicious code execution

http://www.theregister.co.uk/2010/11/24/windows_0day_report/

 

New Windows zero-day flaw bypasses UAC

http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/

 

More info here: https://www.wilderssecurity.com/showthread.php?p=1788801#post1788801

TH

 

http://www.vupen.com/english/advisories/2010/3058

 

so does anyone know if having UAC on maximum on win7 prevents this attack?

 

no it doesn't

 

So, I guess, it means not just bypass of UAC but LUA aswell?

EDIT: nevermind, found the answer and yes it can.

 

I have followed the mitigation provided by Sophos as a precautionary measure

If you don't know which SID is for which user account, then this would help you figure it out:

How to Associate a Username with a Security Identifier (SID)

Source: http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/

Source: http://www.prevx.com/blog/160/New-Windows-day-exploit-speaks-Chinese.html

Question remains: Does it bypass SRP and Applocker? If cmd.exe, regedit.exe is blocked by SRP, would the exploit still work? What about DEP, SEHOP, ASLR, etc? Questions, questions and more questions...

I need answers from those who know or are going to test the POC.

 

It's a local vulnerability, meaning you (or a user on your system) must first run the exploit code somehow before it can do anything, unless it's combined with another exploit.

 

In the latter case, much like Stuxnet with its 4 zero days, the first 2 to break into the system and to spread to the networks and the other two, privilege escalation(s), to elevate rights.

A targetted attack scenario is to combine zero day arbitrary remote code execution with this zero day kernel exploit to have the fearsome and nightmarish scenario of "no user interaction" to bypass AE/UAC/SRP/LUA/AL/AV/HIPS(if not configured to block malicious dll loading barring Didier Steven' dll loading in memory).