Microsoft Windows VCF File memory corruption ⚔ [Disputed]

Summaryinfo

A vulnerability has been found in Microsoft Windows and classified as critical. Impacted is an unknown function of the component VCF File Handler. The manipulation leads to memory corruption. The attack is possible to be carried out remotely. Moreover, an exploit is present. The presence of this vulnerability remains uncertain at this time.

Detailsinfo

A vulnerability was found in Microsoft Windows (Operating System) (the affected version unknown). It has been rated as critical. This issue affects an unknown part of the component VCF File Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 01/10/2019 by John Page (hyp3rlinx) as ZDI-19-013 / ZDI-CAN-6920 as confirmed advisory (Website) via ZDI (Zero Day Initiative). It is possible to read the advisory at hyp3rlinx.altervista.org. The vendor was not involved in the public release. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/29/2020).

A public exploit has been developed by John Page (hyp3rlinx) and been published immediately after the advisory. The exploit is available at hyp3rlinx.altervista.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 216 days. During that time the estimated underground price was around $25k-$100k. The real existence of this vulnerability is still doubted at the moment.

The advisory contains the following remark:

The vendor wrote to ZDI to advise that “engineering team had decided to pursue the fix as v.Next” and “Microsoft has decided that it will not be fixing this vulnerability and we are closing this case”

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #48: Microsoft Windows VCF File Insufficient UI Warning Remote Code Execution 0day ZDI-CAN-6920 (by hyp3rlinx)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion