Week of January 22, 2024

A stack-based buffer overflow vulnerability in Symantec Data Loss Prevention for Windows allows unauthenticated remote code execution. Exploitation requires a user to open a crafted document, leading to high impact on confidentiality, integrity, and availability. The vulnerability affects versions up to 14.0.2 and has a CVSS v3.1 base score of 9.6.

A researcher published a C++ proof-of-concept demonstrating the indirect syscall technique to execute shellcode (calc.exe) while evading EDR userland hooks. The code is open-source under MIT license and serves as an educational resource for understanding syscall-based evasion.

A local privilege escalation vulnerability exists in the Trend Micro Apex One Security Agent updater due to improper link resolution. An attacker with low-privileged code execution can create a junction to abuse the updater and delete an arbitrary folder, leading to SYSTEM-level code execution. Trend Micro has released a patch to address this issue.

A proof-of-concept tool named 'etwunhook' was published on GitHub, demonstrating a method to disable Event Tracing for Windows (ETW) by overwriting the NtTraceEvent function in ntdll.dll with a return instruction. The technique uses indirect syscalls to bypass user-mode hooks and patch the function, effectively blinding security products that rely on ETW for telemetry. This PoC highlights a known evasion method and may aid red teams and attackers in avoiding detection.

CVE-2024-23678 is a path traversal vulnerability in Splunk Enterprise for Windows that leads to unsafe deserialization of untrusted data. A local attacker can exploit improper path sanitization to trigger code execution with the privileges of the Splunk service. The vulnerability affects versions below 9.0.8 and 9.1.3.