Microsoft Windows up to XP Office 2000 File riched20.dll privileges management

Summaryinfo

A vulnerability marked as critical has been reported in Microsoft Windows up to XP. This affects an unknown part in the library riched20.dll of the component Office 2000 File Handler. This manipulation causes privileges management. This vulnerability is registered as CVE-2000-0854. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Microsoft Windows up to XP (Operating System). Affected by this vulnerability is an unknown code in the library riched20.dll of the component Office 2000 File Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL s such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document.

The issue has been introduced in 08/24/1995. The weakness was published 11/14/2000 by Georgi Guninski (Website). The advisory is shared at securityfocus.com. This vulnerability is known as CVE-2000-0854. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. MITRE ATT&CK project uses the attack technique T1068 for this issue.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1909 days. During that time the estimated underground price was around $25k-$100k.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (5263), Exploit-DB (20232) and SecurityFocus (BID 1699†). Similar entry is available at VDB-15982. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 95
• 98
• 98SE
• 2000
• NT 4.0
• XP

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion