#Modern Workplace

The current version and some earlier versions of 7-Zip have a security vulnerability which could allow hackers to escalate privileges. The zero-day referred to as CVE-2022-29072  exploits the misconfiguration of 7z.dll. Hackers can gain unauthorized access to systems when a file with the .7z extension is placed within the Help > Contents area . The command then runs as a child process under the 7zFM.exe process. At present, 7-Zip has not released a security update to address this vulnerability, which means that all current versions of 21.07 are vulnerable. Luckily there is a workaround available to mitigate the vulnerability and through this blog, I will cover the remediation steps of implementing this workaround using ConfigMgr.  Workaround for mitigation To remedy this vulnerability, 7-zip.chm file in the 7-Zip installation directory needs to be deleted. This way the help section of 7-zip becomes unusable and the attackers cannot exploit it any further.  I have creat...

If your organization is using a vulnerability scanning tool then more often than not, vulnerability like  SMB Signing Disabled or SMB Signing Not Required will flag up and probably make it to the top of the list. This is because most organizations may not have SMB signing enabled by default for all their client and server communications. What is SMB signing? SMB signing is a security mechanism in the SMB protocol which is  designed to help improve the  security of the SMB protocol.  SMB signing adds security to a network using NetBIOS, avoiding  man-in-the-middle attacks and w hen enabled on both the client and server, SMB sessions are  authenticated between the machines on the packet level. According to Microsoft , following SMB configuration scenarios can play out - If SMB Signing is enabled and required at both the client and the server, or if SMB signing is disabled at both the client and the server, the connection is successful. If SMB signing is enabl...

For past couple of months, I have been working on a vulnerability assessment project and as part of the exercise, I came across a vulnerability related to MS15-011: Vulnerability in Group Policy could allow remote code execution , that was flagged up on many servers. Nothing unusual about it and is easily fixable as long as you dot all the i’s and cross all the t’s. Nonetheless, I wanted to blog my experience in an endeavor to make it easier for others to implement this, should you choose to follow the method as documented below. What is ‘ MS15-011: Vulnerability in Group Policy could allow remote code execution’ all about? According to official documentation by MS , A remote code execution vulnerability exists in how Group Policy receives and applies connection data when a domain-joined system connects to a domain controller. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, could...