See, when installing an MSI package, Windows Installer gradually builds up a rollback script in case the installation should fail at some point, and all changes made up to that point would have to be reverted. The core of this vulnerability, and all others listed above, is in tricking Windows Installer into using attacker’s own rollback script (a *.rbs file) instead of the rollback script created by msiexec.exe during the installation. This vulnerability is a bypass of Microsoft’s fix for CVE-2020-16902 (described by Abdelhamid in detail here), which was itself a bypass of Microsoft’s fixes for CVE-2020-0814 and CVE-2020-1302 (also found by Abdelhamid), both of which were a bypass of Microsoft’s fix for CVE-2019-1415 (found by Sandbo圎scaper and described here).Ĭonfusing? Well, some things aren’t easy to fix, and Windows Installer is a pretty complex beast that can break a leg if you fix its arm, and then break its tail when you fix the leg. It is a bug in Windows Installer which has been patched, re-patched, re-patched… I don’t think this has anything to do with FAX. My method to avoid this exploit back then, was to remove the Fax from ‘installed features’ This topic was modified 1 year, 1 month ago by Alex5723. (The micropatch would also be the only available patch for Windows 7 without Extended Security Updates (ESU), or Windows 7 with only the first year of ESU.). It took us a while to troubleshoot the underlying problem with reproduction and come January 2021 Patch Tuesday, it turned out this vulnerability wasn’t patched by Microsoft…Having successfully reproduced the issue by then on all Windows versions back to Windows 7, we decided to create a micropatch to protect Windows users waiting for the official patch. We were mostly interested in the latter….Ībdelhamid provided a proof-of-concept (the GitHub repository is disabled at the time of this writing) which allowed us to quickly reproduce the issue on Windows 10 v2004, but we were having difficulties reproducing it on other Windows 10 versions and older Windows systems.

On December 26, security researcher Abdelhamid Naceri published a blog post with a number of 0days in various security products and a local privilege escalation 0day in Windows Installer.

Poser 7 patch