How to fix errors for ACL and SAM vulnerabilities on Windows

Funny caption of hackers spreading WannaCry malicious code
If there is not enough ransom for the file, send an email to complain to the hacker, maybe you will get a surprise gift

The recently discovered CVE-2021-36934 vulnerability is an important issue because it provides elevated privileges to the bad guys.

The elevated privilege vulnerability exists because Access Control Lists (ACLs) are too permissive on many system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with system privileges. They can then install programs, view, change or delete data; or create a new account with full user rights.

To exploit the vulnerability, the bad guys must have access to the system and run the code in the first place. Microsoft is still investigating the issue and more data is expected to be added to the CVE. However, for now, users can try 2 methods to disable the vulnerable part of the operating system.

According to the official version, no vulnerabilities were exploited and Microsoft was quick enough to come up with an alternative. However, the company also mentioned that exploits using the vulnerability are more likely to happen and users must follow the workaround as quickly as possible.

How to fix

First, you have to run Command Prompt or Windows PowerShell command execution application and run below command to limit access to %windir%system32config folder.

With Command Prompt: icacls %windir%system32config*.* /inheritance:e

With PowerShell: icacls $env:windirsystem32config*.* /inheritance:e

How to fix errors for ACL and SAM vulnerabilities on Windows Picture 1

In the second step, the user must delete the copy of the Volume Shadow Copy Service. And will also require deleting System Restore's restore points.

Once they have been removed and access to the %windir%system32config folder is restricted, the user can create another System Restore point.

The problem with the workaround is that the user will lose access to existing System Restores. That won't be a problem for those with another form of backup, but individuals or organizations that rely entirely on System Restore points will be at risk.

It should be noted that the current workaround is a temporary workaround. Microsoft will likely release a patch after thoroughly investigating the issue.

Kareem Winters

Update 03 October 2021

You should read it

May be interested

There is a new zero-day vulnerability in Windows
the vulnerability posted on twitter and on github also has a poc that demonstrates one of the ways this error exploits the machine, making it impossible to boot.
Microsoft released a series of non-bootable patches for Windows 10 on PCs with AMD chips
in order to fix errors that cannot be booted on an amd-based computer with windows 10 installed, microsoft sent users an official update after blocking updates that addressed the previous meltdown and specter vulnerabilities.
How to fix boot errors on Windows 8
if you are using windows 8, you will probably notice that this operating system gives an impressive boot time, much faster than previous windows versions. that's because in windows 8, microsoft applies a new boot feature called 'quick start', which is a combination of cold boot mode and hibernate windows startup.
IBM developed a new technology to patch security holes
top security researchers at ibm have recently developed a new technique to etch almost entirely the impact of security vulnerabilities before they are actually found.
The Mail app on iOS has serious vulnerabilities
security researchers at zecops have discovered two serious vulnerabilities that exist on the default mail application pre-installed on millions of iphones and ipads.
How to fix some errors when updating Windows 10
besides the exciting new features, the windows 10 update also has some problems during and after installing the software. read this article to learn how to fix some of the most common problems of this update.
HP publishes a series of critical vulnerabilities in the Teradici PCoIP protocol
hp has warned of serious security vulnerabilities in the teradici pcoip client and agent for windows, linux, and macos. these vulnerabilities affect 15 million endpoints.
Intel has overcome serious vulnerabilities in graphics drivers for Windows
intel recently announced that it has successfully overcome 20 security vulnerabilities in intel graphics driver for windows.
How to fix Netflix errors that don't work on Windows 10
netflix applications on windows 10 will sometimes encounter some problems, making it impossible to open the application to watch videos.
How to fix windows 10 errors
summary of the latest and most effective ways to fix windows 10 errors, this article will guide you in detail how to fix windows 10 errors to help your system work the best.