{"id":86822,"date":"2018-09-12T19:00:14","date_gmt":"2018-09-12T13:30:14","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=86822"},"modified":"2018-09-12T19:00:14","modified_gmt":"2018-09-12T13:30:14","slug":"cve-2018-8440-task-scheduler-alpc-zero-day-exploit-wild","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/cve-2018-8440-task-scheduler-alpc-zero-day-exploit-wild\/","title":{"rendered":"CVE-2018-8440 &#8211; Task Scheduler ALPC Zero-Day Exploit in the Wild"},"content":{"rendered":"<p>The recent zero-day vulnerability CVE-2018-8440 in Windows Task Scheduler enables attackers to perform a privilege elevation on targeted machines. Microsoft has released a security advisory CVE-2018-8440 on September 11, 2018 to address this issue. According to Microsoft, successful exploitation of this vulnerability could run arbitrary code in the security context of the local system.<\/p>\n<p><strong>About the vulnerability<\/strong><br \/>\nCVE-2018-8440 is a local privilege escalation vulnerability in the Windows Task Scheduler&#8217;s Advanced Local Procedure Call (ALPC) interface. The ALPC endpoint in Windows task scheduler exports the SchRpcSetSecurity function, which allows us to set an arbitrary DACL without checking permissions. Exploiting the vulnerability ultimately allows a local unprivileged user to change the permissions of any file on the system.<\/p>\n<p>The exploit code release was announced on twitter, on 27th August 2018, by a security researcher who goes with the handle &#8220;SandboxEscaper&#8221;.\u00a0 Within days, PowerPool malware was found using the exploit to infect users.<\/p>\n<p><strong>Vulnerable versions<\/strong><\/p>\n<ul>\n<li>Windows 7<\/li>\n<li>Windows 8.1<\/li>\n<li>Windows 10<\/li>\n<li>Windows Server 2008, 2012 and 2016<\/li>\n<\/ul>\n<p><strong>Quick Heal detection<\/strong><br \/>\nQuick Heal has released the following detection for the vulnerability CVE-2018-8440:<\/p>\n<ul>\n<li>Trojan.Win64<\/li>\n<li>Trojan.IGeneric<\/li>\n<\/ul>\n<p>Quick Heal Security Labs is actively looking for new in-the-wild exploits for this vulnerability and ensuring coverage for them.<\/p>\n<p><strong>References<\/strong><\/p>\n<ul>\n<li>https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2018-8440<\/li>\n<\/ul>\n<p><strong>Subject Matter Experts<\/strong><\/p>\n<p>Sameer Patil |\u00a0Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The recent zero-day vulnerability CVE-2018-8440 in Windows Task Scheduler enables attackers to perform a privilege elevation on targeted machines. Microsoft has released a security advisory CVE-2018-8440 on September 11, 2018 to address this issue. According to Microsoft, successful exploitation of this vulnerability could run arbitrary code in the security context of the local system. About [&hellip;]<\/p>\n","protected":false},"author":46,"featured_media":85593,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[75,5],"tags":[1621,1173,1249],"class_list":["post-86822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-windows","category-security","tag-cve-2018-8440","tag-exploit","tag-windows"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86822"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=86822"}],"version-history":[{"count":2,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86822\/revisions"}],"predecessor-version":[{"id":86825,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86822\/revisions\/86825"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/85593"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=86822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=86822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=86822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}