WampServer 3.0.6 wampapache/wampmysqld access control ⚔ [Disputed]

Summaryinfo

A vulnerability was found in WampServer 3.0.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the component wampapache/wampmysqld. Performing a manipulation results in access control. This vulnerability is cataloged as CVE-2016-10031. The attack must be initiated from a local position. Furthermore, there is an exploit available. It is still unclear if this vulnerability genuinely exists.

Detailsinfo

A vulnerability classified as problematic has been found in WampServer 3.0.6. This affects an unknown function of the component wampapache/wampmysqld. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

** DISPUTED ** WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local attacker must insert an executable file called mysqld.exe or httpd.exe and replace the original files. The next time the service starts, the malicious file will get executed as SYSTEM. NOTE: the vendor disputes the relevance of this report, taking the position that a configuration in which "'someone' (an attacker) is able to replace files on a PC" is not "the fault of WampServer."

The bug was discovered 12/26/2016. The weakness was shared 12/27/2016 (Website). The advisory is shared at forum.wampserver.com. This vulnerability is uniquely identified as CVE-2016-10031 since 12/22/2016. An attack has to be approached locally. The successful exploitation requires a authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (40967). The entry VDB-94690 is related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• WampServer

Version

• 3.0.6

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion