Zero-day flaw puts all Windows 10 and Windows 11 PCs at risk — what to do
Goose egg-day flaw puts all Windows x and Windows 11 PCs at take chances — what to exercise
A nasty new security flaw lets hackers take over Windows x and Windows xi machines — and at that place'southward no ready available even so.
A working exploit for the flaw, which its creator calls "InstallerFileTakeOver," was posted on the Microsoft-owned software repository GitHub this past Sunday (Nov. 21).
Because our workplace computers are locked downwards past our Information technology department, we oasis't been able to try out InstallerFileTakeOver. But several security experts say it works just fine and gives full system command to logged-in users who normally shouldn't be able to install, delete or modify programs.
Yeah, this LPE indeed works fine on a fully-patched Windows 11 system. https://t.co/7v0oXSZrnM pic.twitter.com/kvvISKabeGNovember 22, 2021
"This vulnerability affects every version of Microsoft Windows, including fully patched Windows 11 and Server 2022," said researchers at Cisco Talos yesterday (Nov. 23). "Talos has already detected malware samples in the wild that are attempting to take advantage of this vulnerability."
Can ostend this works, local priv esc. Tested on Windows 10 20H2 and Windows 11.The prior patch MS issued didn't prepare the issue properly. https://t.co/OEdmtlMZvYNovember 22, 2021
Unfortunately, in that location'due south no sure-fire way to protect your PC only even so, equally the exploit's creator, Moroccan researcher Abdelhamid Naceri, explained in his GitHub post.
"The best workaround available at the time of writing this is to wait Microsoft to release a security patch, due to the complication of this vulnerability," wrote Naceri. "Any try to patch the binary directly will break Windows Installer," the Windows 10 and Windows xi plan that updates Microsoft software.
The best way to defend yourself is to install and run some of the all-time Windows antivirus software, free or paid. Don't open files that randomly come up to you from websites, email messages, social media or instant messages. And go along a close eye on who has admission to your computer.
There's some defence force in the fact that the set on has to commencement with a user who's already logged into the system. But the attacker doesn't have to be a homo — malware that made information technology onto the machine by other means could simply as easily exploit this flaw.
Source: https://www.tomsguide.com/news/windows-installer-file-takeover-flaw
Posted by: harrodficul1984.blogspot.com
0 Response to "Zero-day flaw puts all Windows 10 and Windows 11 PCs at risk — what to do"
Post a Comment