CVE-2021-26413: 
vulnerability analysis and mitigation

Windows Installer Spoofing Vulnerability (CVE-2021-26413) is a security flaw discovered in Microsoft Windows Installer that could allow an attacker to bypass signature validation checks. The vulnerability was disclosed to Microsoft on December 4th, 2020, and a patch was released on April 13th, 2021. This vulnerability affects various versions of Microsoft Windows, including Windows 10, Windows 8.1, and Windows 7 SP1 (Okta Security).

The vulnerability exists due to Windows Installer's failure to account for unallocated bytes in Compound File Binary format files. These unallocated bytes are not considered when computing and verifying signatures, allowing attackers to insert malicious data while maintaining the signature's validity. The vulnerability has a CVSS 3.1 Base Score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (NVD).

This vulnerability could allow an attacker to disguise malicious software as legitimate signed software, potentially bypassing security checks and escalating privileges. In specific cases, a low-privilege attacker could provide a malicious MSI file to a Windows service, bypass signature checks, and execute malicious code with SYSTEM privileges (Okta Security).

The vulnerability has some exploitation limitations due to the restricted size of unallocated byte ranges. However, attackers can leverage HTA files and their lax parsing to deliver small payloads. The technique is particularly concerning as it allows malware authors to disguise malicious software as legitimate signed applications (Okta Security).

Microsoft has released security updates to address this vulnerability. For applications that rely on WinVerifyTrust, it is recommended to implement additional security checks such as full file checksums, file size verification, and file extension validation. The patch implements fixes in MSISIP!IsSupportedFileType to prevent files with .jar and .hta extensions from being processed by the MSI SIP (Okta Security).