A flaw in vCard processing could allow hackers to compromise a Win PC

A security expert discovered a zero-day flaw in the processing of VCard files that could be exploited by a remote attacker to compromise a Windows PC

The security expert John Page (@hyp3rlinx), discovered a zero-day vulnerability in the processing of VCard files that could be exploited by a remote attacker, under certain conditions, to hack Windows PC. The expert reported the flaw to Microsoft via the Trend Micro’s Zero Day Initiative (ZDI).

“This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” reads the security advisory on ZDI.

“The specific flaw exists within the processing of VCard files. Crafted data in a VCard file can cause Windows to display a dangerous hyperlink. The user interface fails to provide any indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of the current user.”

The flaw was first reported on 08/06/18, Microsoft acknowledged the report and provided a tracking number and requested a PoC to the expert.
On 10/03/18, the vendor advised the report did not meet the bar for service, but in the last turn Microsoft decided to patch it.

An attacker can use create a specially crafted VCard file that contains in the contact’s website URL field that points to a local executable file.
This second file can be sent within a zipped file as an email attachment or delivered via drive-by-download attacks.

In the following video PoC, when the victim clicks that website URL, the Windows operating system would execute the malicious file without displaying any warning. John Page also published proof-of-concept exploit code for the vulnerability,

“This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of VCard files.” reads the advisory published by the expert.

“Crafted data in a VCard file can cause Windows to display a dangerous hyperlink. The user interface fails to provide any indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of the current user.”

https://vimeo.com/310684003

The expert pointed out that the exploitation of this flaw requires user interaction, the victims have to visit a specially crafted page or open a malicious file.

The flaw has received a CVSS 3.0 score of 7.8.

Source:  Pierluigi Paganini
Editor-in-Chief, Cyber Defense Magazine

January 19, 2019

cyber defense awardsWe are in our 11th year, and Global InfoSec Awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.
Cyber Defense Awards

12th Anniversary Global InfoSec Awards for 2024 are now Open! Take advantage of co-marketing packages and enter today!

X