Week of March 11, 2024

CVE-2024-1853 is a denial-of-service vulnerability in Zemana AntiLogger v2.74.204.664. The flaw exists in the zam64.sys and zamguard64.sys kernel drivers, allowing a local low-privilege attacker to terminate arbitrary processes by sending a crafted IOCTL request with code 0x80002048. This can cause system instability or disable security software.

ACR Stealer, a malware-as-a-service infostealer, is actively exploiting CVE-2024-21412 to bypass Microsoft Defender SmartScreen. The attack chain uses phishing emails with malicious links to WebDAV-hosted internet shortcuts, leading to DLL sideloading and execution of the payload. This allows the malware to steal sensitive information without triggering SmartScreen warnings.

A vulnerability in Microsoft Defender allows local attackers with low privileges to bypass security features due to incorrect default permissions. The flaw has a CVSS score of 5.5 and primarily impacts system availability. Microsoft released a patch on March 12, 2024.

A local privilege escalation vulnerability exists in Checkmk Agent versions 2.0.0, 2.1.0, and 2.2.0. The agent creates temporary .cmd files in C:\Windows\Temp with predictable names and executes them with SYSTEM privileges. An attacker with local access can place a malicious file in that directory to achieve privilege escalation.