This zero-day elevation-of-privilege vulnerability, tracked as HiveLegacy, exploits a flaw in the Windows User Profile Service, allowing low-privileged users to modify an administrator account's registry hive to gain higher privileges. The article does not provide a CVSS score, specific affected Windows versions, a fixed version, or a workaround, noting only that Microsoft is scrambling to develop a patch following the public release of proof-of-concept exploit code.
Right on the heels of Microsoft releasing a record number of security patches, a researcher has published exploit code that can give low-privileged Windows accounts the ability to make sensitive changes to administrator accounts. The exploit, which multiple researchers say works , is sending Microsoft scrambling, yet again, to patch a zeroday released by an anonymous researcher who has complained about the software maker’s handling of their bug reports. To date, the pseudonymous NightmareEclypse has published nine such exploits, including Tuesday’s HiveLegacy . The researcher said the proof-of-concept code included in the report was stripped down to prevent attackers from using it maliciously. A “pretty powerful primitive” HiveLegacy is an elevation-of-privilege exploit that targets a vulnerability residing in the Windows User Profile Service. It allows users (and with more work likely processes) with limited system rights to compromise an admin user's account by modifying its classes registry hive , a resource that ensures the correct application opens when certain types of files are clicked on in Windows Explorer. Read full article Comments