Pierluigi Paganini February 02, 2022

Antivirus firm ESET addressed a local privilege escalation vulnerability, tracked CVE-2021-37852, impacting its Windows clients.

Antivirus firm ESET released security patches to address a high severity local privilege escalation vulnerability, tracked CVE-2021-37852, impacting its Windows clients.

An attacker can exploit the vulnerability to misuse the AMSI scanning feature to elevate privileges in specific scenarios.

“According to the report, submitted by the Zero Day Initiative (ZDI), an attacker who is able to get SeImpersonatePrivilege can misuse the AMSI scanning feature to elevate to NT AUTHORITY\SYSTEM in some cases.” reads the security advisory published by the company. “The SeImpersonatePrivilege is by default available to the local Administrators group and the device’s Local Service accounts, which are already highly privileged and thus limit the impact of this vulnerability.”

The CVE-2021-37852 vulnerability was discovered by the security researcher Michael DePlante (@izobashi) who reported the bug reported to the company through the Zero Day Initiative (ZDI).

ZDI also published an advisory for this issue. The vulnerability impacted products include multiple versions of ESET NOD32 Antivirus, Internet Security, Smart Security and Smart Security Premium, Endpoint Antivirus and Endpoint Security for Windows, Server Security and File Security for Windows Server, Server Security for Azure, Security for SharePoint Server, and Mail Security for IBM Domino and for Exchange Server.ESET released a series of patches for this issue in December 2021, and in January released fixes for older versions of the company products.

The security firm also provides the following mitigation for this flaw:

“The attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products’ Advanced setup.” continues the advisory. “However, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible for an important reason.”

The good news for the customers of the security firm is that it is not aware of existing exploits for this issue.

“To the best of our knowledge, there are no existing exploits that take advantage of this vulnerability in the wild,” ESET concldues.

ESET said it became aware of the flaw in November, but ZDI said the issue was reported to the vendor in June.

Below is the disclosure timeline:

• 2021-06-18 – Vulnerability reported to vendor
• 2022-01-31 – Coordinated public release of advisory

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, privilege escalation)

[adrotate banner=”5″]

[adrotate banner=”13″]