Microsoft Windows Extension privileges management

Summaryinfo

A vulnerability, which was classified as critical, was found in Microsoft Windows. This affects an unknown part of the component Extension Handler. Executing a manipulation can lead to privileges management. The attack needs to be launched locally. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Microsoft Windows (Operating System) (affected version not known). It has been declared as critical. This vulnerability affects some unknown functionality of the component Extension Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was published 06/17/2019 by John Page as not defined advisory (Website). The advisory is shared for download at hyp3rlinx.altervista.org. The public release happened without coordination with the vendor. The attack needs to be approached locally. A single authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

After immediately, there has been an exploit disclosed. It is possible to download the exploit at hyp3rlinx.altervista.org. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k. The advisory illustrates:

When a MS Word ".docx" File contains a hyperlink to another file, it will run the first file it finds in that directory with a valid extension. But will present to the end user an extension-less file in its Security warning dialog box without showing the extension type. If another "empty" file of the same name as the target executable exists but has no file extension. Because the extension is supressed it makes the file seem harmless and the file can be masked to appear as just a folder etc.

The advisory contains the following remark:

ZDI Response: "We have synced with the vendor and they have resolved that this case does not meet the bar for security servicing. Therefore we will proceed to close it on our end."

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #71: Microsoft Word (2016) Deceptive File Reference ZDI-CAN-7949 (by hyp3rlinx)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion