Microsoft Windows Privilege Escalation Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-28
• Known to be used in ransomware campaigns
• EPSS: 84% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.

CISA: Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Apr 2022): Apply updates per vendor instructions.

• Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.securityfocus.com/bid/98102Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1038457Broken LinkThird Party AdvisoryVDB Entry
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213PatchVendor Advisory
• www.exploit-db.com/exploits/42020ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource