Microsoft Windows up to Server 2019 Event Viewer eventvwr.msc information disclosure

Summaryinfo

A vulnerability has been found in Microsoft Windows and classified as critical. This issue affects some unknown processing of the file eventvwr.msc of the component Event Viewer. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2019-0948. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows (Operating System). It has been rated as critical. This issue affects an unknown part of the file eventvwr.msc of the component Event Viewer. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity, aka 'Windows Event Viewer Information Disclosure Vulnerability'.

The weakness was shared 06/11/2019 by hyp3rlinx as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The vendor cooperated in the coordination of the public release. The identification of this vulnerability is CVE-2019-0948 since 11/26/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1592 for this issue. The advisory points out:

An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 91544 (Microsoft Windows Security Update for June 2019).

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (40863). The entries VDB-136348, VDB-136347 and VDB-136345 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1
• 8.1
• 10
• 10 1607
• 10 1703
• 10 1709
• 10 1803
• 10 1809
• 10 1903
• RT 8.1
• Server 1803
• Server 1903
• Server 2008 R2 SP1
• Server 2008 SP2
• Server 2012
• Server 2012 R2
• Server 2016
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion