{"id":21631,"date":"2021-04-14T10:29:26","date_gmt":"2021-04-14T16:29:26","guid":{"rendered":"https:\/\/latam.kaspersky.com\/blog\/?p=21631"},"modified":"2021-04-14T10:29:26","modified_gmt":"2021-04-14T16:29:26","slug":"vulnerabilidad-de-dia-cero-en-desktop-window-manager","status":"publish","type":"post","link":"https:\/\/latam.kaspersky.com\/blog\/vulnerabilidad-de-dia-cero-en-desktop-window-manager\/21631\/","title":{"rendered":"Vulnerabilidad de d\u00eda cero en Desktop Window Manager"},"content":{"rendered":"<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #0d0d0d\">Una vulnerabilidad o exploit de d\u00eda cero es b\u00e1sicamente un error de software desconocido. Una vez identificados y descubiertos, permiten a los atacantes realizar actividades maliciosas en la sombra, con consecuencias inesperadas y destructivas.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #0d0d0d\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">Mientras analizaban el exploit <\/span><span lang=\"RU\"><a href=\"https:\/\/ti.dbappsecurity.com.cn\/blog\/index.php\/2021\/02\/10\/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack\/\" target=\"_blank\" rel=\"noopener nofollow\"><span lang=\"ES\">CVE-2021-1732<\/span><\/a><\/span><span lang=\"ES\">, nuestros expertos encontraron otra vulnerabilidad de d\u00eda cero de este tipo y lo comunicaron a Microsoft en febrero. Tras confirmar que se trataba efectivamente de un d\u00eda cero, recibi\u00f3 la denominaci\u00f3n CVE-2021-28310.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">Seg\u00fan los investigadores, esta vulnerabilidad se usa \u201cin-the-wild\u201d, potencialmente por varios actores de amenaza. Se trata de un exploit de escalada de privilegios (EoP), encontrado en Desktop Window Manager, que permite a los atacantes ejecutar c\u00f3digo arbitrario en la computadora de la v\u00edctima.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">Es probable que la vulnerabilidad se utilice junto con otros exploits del navegador para escapar del sandbox u obtener privilegios del sistema para un mayor acceso.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">Todav\u00eda no se sabe si el exploit se utiliza con otro d\u00eda cero o se combina con vulnerabilidades conocidas y parcheadas.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><i><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">\u201cEl exploit fue identificado inicialmente por nuestra avanzada tecnolog\u00eda de prevenci\u00f3n de exploits y los registros de detecci\u00f3n correspondientes. De hecho, en los \u00faltimos a\u00f1os hemos incorporado a nuestros productos una multitud de tecnolog\u00edas de protecci\u00f3n contra exploits que han detectado varios d\u00edas cero, demostrando su eficacia una y otra vez. Seguiremos mejorando la protecci\u00f3n para nuestros usuarios mediante la mejora de nuestras tecnolog\u00edas y la colaboraci\u00f3n con terceros<\/span><\/i><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\"> <i>proveedores para parchear las vulnerabilidades, haciendo que Internet sea m\u00e1s segura para todos\u201d,<\/i> comenta <b>Boris Larin, experto en seguridad de Kaspersky.<\/b><\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><b><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">\u00a0<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">Los clientes del servicio de informes de inteligencia de Kaspersky pueden obtener m\u00e1s informaci\u00f3n sobre BITTER APT y los IOC a trav\u00e9s del correo electr\u00f3nico <\/span><span lang=\"RU\"><a href=\"mailto:intelreports@kaspersky.com\" target=\"_blank\" rel=\"noopener\"><span lang=\"ES\" style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">intelreports@kaspersky.com<\/span><\/a><\/span><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">El 13 de abril de 2021 <\/span><span lang=\"ES\" style=\"color: #232627\">se <\/span><span lang=\"RU\"><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-28310\" target=\"_blank\" rel=\"noopener nofollow\"><span lang=\"ES\">public\u00f3<\/span><\/a><\/span><span lang=\"ES\" style=\"color: #232627\"> un<span style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\"> parche para la vulnerabilidad de elevaci\u00f3n de privilegios CVE-2021-28310.<\/span><\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;line-height: 115%\"><span lang=\"ES\">Los productos de Kaspersky detectan este exploit con los siguientes veredictos:<\/span><\/p>\n<p>\u00a0<\/p>\n<p class=\"MsoListParagraphCxSpFirst\" style=\"margin-bottom: .0001pt;text-indent: -.25in;line-height: 115%\"><!-- [if !supportLists]--><span style=\"font-family: Symbol\">\u00b7<span style=\"font-size: 7pt;line-height: normal;font-family: 'Times New Roman'\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><!--[endif]-->HEUR:Exploit.Win32.Generic<\/p>\n<p class=\"MsoListParagraphCxSpMiddle\" style=\"margin-bottom: .0001pt;text-indent: -.25in;line-height: 115%\"><!-- [if !supportLists]--><span style=\"font-family: Symbol\">\u00b7<span style=\"font-size: 7pt;line-height: normal;font-family: 'Times New Roman'\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><!--[endif]-->HEUR:Trojan.Win32.Generic<\/p>\n<p class=\"MsoListParagraphCxSpLast\" style=\"margin-bottom: .0001pt;text-indent: -.25in;line-height: 115%\"><!-- [if !supportLists]--><span style=\"font-family: Symbol\">\u00b7<span style=\"font-size: 7pt;line-height: normal;font-family: 'Times New Roman'\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><!--[endif]-->PDM:Exploit.Win32.Generic<\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><b><span style=\"color: #232627;background: yellow\">\u00a0<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><b><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">Para mantenerse a salvo de esta amenaza, recomendamos tomar las siguientes medidas de seguridad:<\/span><\/b><\/p>\n<p>\u00a0<\/p>\n<ul style=\"margin-top: 0in\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"color: #232627;margin-bottom: .0001pt;text-align: justify;line-height: 107%\"><span lang=\"ES\" style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">Instalar los parches para la nueva vulnerabilidad lo antes posible. Una vez descargados, los ciberdelincuentes ya no pueden abusar de la vulnerabilidad.<\/span><\/li>\n<\/ul>\n<ul style=\"margin-top: 0in\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"color: #232627;margin-bottom: .0001pt;text-align: justify;line-height: 107%\"><span lang=\"ES\" style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">Las capacidades de gesti\u00f3n de vulnerabilidades y parches de una <\/span><span lang=\"RU\" style=\"color: #262626\"><a href=\"https:\/\/latam.kaspersky.com\/enterprise-security\/endpoint\" target=\"_blank\" rel=\"noopener\"><span lang=\"ES\" style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">soluci\u00f3n de protecci\u00f3n para <i>endpoints<\/i><\/span><\/a><\/span><span lang=\"ES\" style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\"> pueden simplificar considerablemente la tarea de los responsables de seguridad inform\u00e1tica.<\/span><\/li>\n<\/ul>\n<ul style=\"margin-top: 0in\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"color: #232627;margin-bottom: .0001pt;text-align: justify;line-height: 107%\"><span lang=\"ES\" style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">Proporcione a su equipo SOC acceso a la \u00faltima inteligencia sobre amenazas (IA). <\/span><span lang=\"RU\" style=\"color: #262626\"><a href=\"https:\/\/latam.kaspersky.com\/enterprise-security\/threat-intelligence-subscription\" target=\"_blank\" rel=\"noopener\"><span lang=\"ES\" style=\"line-height: 107%\">Kaspersky Threat Intelligence Portal<\/span><\/a><\/span><span lang=\"ES\" style=\"background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\"> es un punto de acceso \u00fanico a la inteligencia sobre amenazas de la compa\u00f1\u00eda, que proporciona datos de ciberataques e informaci\u00f3n recopilados por Kaspersky durante m\u00e1s de 20 a\u00f1os.<\/span><\/li>\n<\/ul>\n<ul style=\"margin-top: 0in\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify;line-height: 107%\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">Adem\u00e1s de adoptar la protecci\u00f3n b\u00e1sica para <i>endpoints<\/i>, implemente una soluci\u00f3n de seguridad corporativa que detecte las amenazas avanzadas a nivel de red en una etapa temprana, como <\/span><span lang=\"RU\"><a href=\"https:\/\/latam.kaspersky.com\/enterprise-security\/anti-targeted-attack-platform\" target=\"_blank\" rel=\"noopener\"><span lang=\"ES\" style=\"line-height: 107%\">Kaspersky Anti Targeted Attack Platform<\/span><\/a><\/span><span lang=\"ES\" style=\"line-height: 107%;color: #0d0d0d\">.<\/span><\/li>\n<\/ul>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">Para m\u00e1s detalles sobre los nuevos exploits, consulte el informe completo en <\/span><span lang=\"RU\"><a href=\"https:\/\/securelist.com\/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild\/101898\/\" target=\"_blank\" rel=\"noopener\"><span lang=\"ES\">Securelist<\/span><\/a><\/span><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\">.<\/span><\/p>\n<p>\u00a0<\/p>\n<p class=\"MsoNormal\" style=\"margin-bottom: .0001pt;text-align: justify\"><span lang=\"ES\" style=\"color: #232627;background-image: initial;background-position: initial;background-size: initial;background-attachment: initial\"> <input type=\"hidden\" class=\"category_for_banner\" value=\"kesb-trial\"><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A principios de 2021, y tras analizar m\u00e1s a fondo el exploit CVE-2021-1732 ya reportado y utilizado por el grupo de APT BITTER, nuestros investigadores lograron descubrir otra vulnerabilidad de d\u00eda cero. <\/p>\n","protected":false},"author":2526,"featured_media":21632,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3145,2795,3539,6,9,3540],"tags":[3930,593,5066,498,2081,647,79],"class_list":{"0":"post-21631","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"category-business","9":"category-enterprise","10":"category-news","11":"category-products","12":"category-smb","13":"tag-ataque-dirigido","14":"tag-ciberseguridad","15":"tag-desktop-windows-manager","16":"tag-dia-cero","17":"tag-exploits","18":"tag-vulnerabilidades","19":"tag-windows"},"hreflang":[{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/vulnerabilidad-de-dia-cero-en-desktop-window-manager\/21631\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/latam.kaspersky.com\/blog\/tag\/dia-cero\/","name":"dia cero"},"_links":{"self":[{"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/21631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2526"}],"replies":[{"embeddable":true,"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=21631"}],"version-history":[{"count":1,"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/21631\/revisions"}],"predecessor-version":[{"id":21633,"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/21631\/revisions\/21633"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/21632"}],"wp:attachment":[{"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=21631"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=21631"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/latam.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=21631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}