Hello, welcome to the Wednesday, November 24, 2021 edition of the Sandtonet Storm Center's

Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

I've got only a couple of quick stories today. Did he improved a bit on his Yara signatures that he published on

Monday. These new signatures are removing a couple false positives that he ran into after further

testing these signatures. So again, if you want to use Yara to detect malicious office documents,

malicious here means pretty much anything with a macro,

then definitely take a look at these simple signatures.

Probably the biggest story to keep an eye on is the new Windows installer vulnerability.

I talked about that yesterday. There are new proof of concepts out there, and apparently, according to Cisco, it's already being exploited in the wild

by Malver that uses this vulnerability for privilege escalation. This is a privilege escalation vulnerability, so the code

has to run as a legitimate user with credentials, but then can be leveraged to gain administrator

rights. And again, this was sort of patched in the last patch Tuesday in November, but wasn't patched completely, and this new version of

the exploit is bypassing the current patch.

Talking about ProVage Escalation, there is also a Proach Escalation Vulnerability in Oracle's

Virtual Box, and there are now more details about this particular

vulnerability, which has been patched back in July, so you hopefully have this already applied.

New virtualization vulnerabilities, we do have an important advisory from the Amber for V-Center server.

Important vulnerability patched here could be used for arbitrary file read and it's a server-side request for jury vulnerability.

I don't think any of this requires immediate action, so I hope you step

away a little bit from your computers over the weekend and get some rest and don't get

pulled in by family to patch and update their computers. And for everybody outside of the

US, well, enjoy the low news cycle that usually comes

...