CVE-2021-41379

Windows Installer Elevation of Privilege Vulnerability

Recent assessments:

NinjaOperator at November 22, 2021 3:59pm UTC reported:

According to Florian Roth: “You can detect the exploitation of Windows InstallerFileTakeOver LPE CVE-2021-41379 with the published PoC with events from the ‘Application’ Eventlog
Search for EventID 1033 and the keyword ‘test pkg’
<https://twitter.com/cyb3rops/status/1462711685484101634&gt;

jbaines-r7 at December 03, 2021 7:27pm UTC reported:

According to Florian Roth: “You can detect the exploitation of Windows InstallerFileTakeOver LPE CVE-2021-41379 with the published PoC with events from the ‘Application’ Eventlog
Search for EventID 1033 and the keyword ‘test pkg’
<https://twitter.com/cyb3rops/status/1462711685484101634&gt;

gwillcox-r7 at November 24, 2021 9:16pm UTC reported:

According to Florian Roth: “You can detect the exploitation of Windows InstallerFileTakeOver LPE CVE-2021-41379 with the published PoC with events from the ‘Application’ Eventlog
Search for EventID 1033 and the keyword ‘test pkg’
<https://twitter.com/cyb3rops/status/1462711685484101634&gt;

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 4