Microsoft Wireless Desktop 2000 Storage Management privileges management

Summaryinfo

A vulnerability classified as critical has been found in Microsoft Wireless Desktop 2000. Affected by this issue is some unknown functionality of the component Storage Management. Performing a manipulation results in privileges management. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Microsoft Wireless Desktop 2000 (version now known). This affects some unknown processing of the component Storage Management. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 10/10/2016 by Gerhard Klostermeier and Matthias Deeg with SYSS as not defined mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. The public release was coordinated with Microsoft. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 06/10/2019). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. The advisory points out:

[T]he embedded flash memory of the wireless keyboard Microsoft Wireless Desktop 2000 and of the corresponding USB dongle can be read and written via the SPI interface of the used transceivers with an embedded microcontroller nRF24LE1H (keyboard) and nRF24LU1+ (USB dongle) as the flash memory is not protected by the offered read back protection feature (RDISMB - Read DISable Main Block).

The vulnerability was handled as a non-public zero-day exploit for at least 171 days. During that time the estimated underground price was around $25k-$100k. The advisory illustrates:

Thus, an attacker with physical access to the keyboard or the USB dongle can simply read and write the SPI-addressable code and data flash memory. Due to the use of nRF24 transceiver versions with one-time programmable memory, write access is limited in such a way that a set 1 bit can be changed to a 0 bit but not vice versa. The AES cryptographic key used by the Microsoft Wireless Desktop 2000 keyboard and the corresponding USB dongle is for both devices accessible via the SPI interface.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Microsoft

Name

• Wireless Desktop 2000

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion