#Modern Workplace

The current version and some earlier versions of 7-Zip have a security vulnerability which could allow hackers to escalate privileges. The zero-day referred to as CVE-2022-29072  exploits the misconfiguration of 7z.dll. Hackers can gain unauthorized access to systems when a file with the .7z extension is placed within the Help > Contents area . The command then runs as a child process under the 7zFM.exe process. At present, 7-Zip has not released a security update to address this vulnerability, which means that all current versions of 21.07 are vulnerable. Luckily there is a workaround available to mitigate the vulnerability and through this blog, I will cover the remediation steps of implementing this workaround using ConfigMgr.  Workaround for mitigation To remedy this vulnerability, 7-zip.chm file in the 7-Zip installation directory needs to be deleted. This way the help section of 7-zip becomes unusable and the attackers cannot exploit it any further.  I have creat...

  Apple just released 15.3.1 update for iOS & iPadOS that contains some important fixes. Including the Webkit vulnerability which is being actively exploited at the moment. You can follow all the latest on Apple's twitter handle . If you are managing devices using Intune, then you can force your users to install the update immediately. Configure the following settings in your compliace policy. If you have devices older than iOS 15, then you may want to use device filters to make sure that the compliance policy only applies to devices running iOS 15 and then possibly create a separate policy for older iOS devices. End User Experience Once Company Portal syncs with Intune, the compliance policy will get updated and the user will receive the Push notification. If your devices are onboarded on Defender for Endpoint, then MDE will also trigger a notification to update the OS with latest security patch. I have a different post coming on the whole MDE enollment configuration for Andr...

For past couple of months, I have been working on a vulnerability assessment project and as part of the exercise, I came across a vulnerability related to MS15-011: Vulnerability in Group Policy could allow remote code execution , that was flagged up on many servers. Nothing unusual about it and is easily fixable as long as you dot all the i’s and cross all the t’s. Nonetheless, I wanted to blog my experience in an endeavor to make it easier for others to implement this, should you choose to follow the method as documented below. What is ‘ MS15-011: Vulnerability in Group Policy could allow remote code execution’ all about? According to official documentation by MS , A remote code execution vulnerability exists in how Group Policy receives and applies connection data when a domain-joined system connects to a domain controller. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, could...