Windows ‘InstallerFileTakeOver’ Bug Micropatch Is Now Out

An unofficial patch has been released for a zero-day vulnerability that is actively exploited to gain administrator privileges.

Proof-of-concept (PoC) exploit code that runs out of the box has been published for the current release, known as the “InstallerFileTakeOver” bug.

The vulnerability affects all versions of Windows and can be exploited by attackers with limited local accounts to escalate privileges and execute code with full admin privileges.

Abdelhamid Naceri, researcher and creator of the Poc, discovered the bug while analyzing the patch for another privilege escalation bug he reported to Microsoft and which is currently being tracked as CVE-2021-41379.

Naceri found that Microsoft’s fix was incomplete, allowing code to be executed with administrator privileges. He also explained that the new variant, which does not yet have a CVE identifier, “is more powerful than the original one.”

Mitja Kolsek, co-founder of the 0patch service, which offers hotfixes that do not require a reboot of the system, says that the error stems from the way the Windows installer creates a Rollback File (.RBF) that enables restoring the data that has been changed or deleted during the installation process.

The 0Patch code checks that there are no junctions or links in the destination path of the RBF file. Otherwise, it will block the movement of the file to eliminate the risk of exploitation.

The micropatch is free and works on Windows 7 ESU, Windows 10, Server 2008 ESU/2012/2016/2019, with a published video demonstrating what the micropatch does.

The 0Patch correcting code is a temporary solution with the aim of insulating systems until Microsoft provides a permanent patch for the problem, which has not yet happened.

At the moment, the best defense is to run the 0Patch temporary fix, which can be used without any need to restart the machine.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web