ESET releases fixes for local privilege escalation bug in Windows Applications

Antivirus firm ESET addressed a local privilege escalation vulnerability, tracked CVE-2021-37852, impacting its Windows clients.

Antivirus firm ESET released security patches to address a high severity local privilege escalation vulnerability, tracked CVE-2021-37852, impacting its Windows clients.

An attacker can exploit the vulnerability to misuse the AMSI scanning feature to elevate privileges in specific scenarios.

“According to the report, submitted by the Zero Day Initiative (ZDI), an attacker who is able to get SeImpersonatePrivilege can misuse the AMSI scanning feature to elevate to NT AUTHORITY\SYSTEM in some cases.” reads the security advisory published by the company. “The SeImpersonatePrivilege is by default available to the local Administrators group and the device’s Local Service accounts, which are already highly privileged and thus limit the impact of this vulnerability.”

The CVE-2021-37852 vulnerability was discovered by the security researcher Michael DePlante (@izobashi) who reported the bug reported to the company through the Zero Day Initiative (ZDI).

ZDI also published an advisory for this issue. The vulnerability impacted products include multiple versions of ESET NOD32 Antivirus, Internet Security, Smart Security and Smart Security Premium, Endpoint Antivirus and Endpoint Security for Windows, Server Security and File Security for Windows Server, Server Security for Azure, Security for SharePoint Server, and Mail Security for IBM Domino and for Exchange Server.ESET released a series of patches for this issue in December 2021, and in January released fixes for older versions of the company products.

The security firm also provides the following mitigation for this flaw:

“The attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products’ Advanced setup.” continues the advisory. “However, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible for an important reason.”

The good news for the customers of the security firm is that it is not aware of existing exploits for this issue.

“To the best of our knowledge, there are no existing exploits that take advantage of this vulnerability in the wild,” ESET concldues.

ESET said it became aware of the flaw in November, but ZDI said the issue was reported to the vendor in June.

Below is the disclosure timeline:

2021-06-18 – Vulnerability reported to vendor
2022-01-31 – Coordinated public release of advisory

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, privilege escalation)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.