A security expert discovered a zero-day flaw in the processing of VCard files that could be exploited by a remote attacker to compromise a Windows PC
The security expert John Page (@hyp3rlinx), discovered a zero-day vulnerability in the processing of VCard files that could be exploited by a remote attacker, under certain conditions, to hack Windows PC. The expert reported the flaw to Microsoft via the Trend Micro’s Zero Day Initiative (ZDI).
“This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” reads the security advisory on ZDI.
“The specific flaw exists within the processing of VCard files. Crafted data in a VCard file can cause Windows to display a dangerous hyperlink. The user interface fails to provide any indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of the current user.”
The flaw was first reported on 08/06/18, Microsoft acknowledged the report and provided a tracking number and requested a PoC to the expert.
On 10/03/18, the vendor advised the report did not meet the bar for service, but in the last
An attacker can use create a specially crafted VCard file that contains in the contact’s website URL field that points to a local executable file.
This second file can be sent within a zipped file as an email attachment or delivered via drive-by-download attacks.
In the following video PoC, when the victim clicks that website URL, the Windows operating system would execute the malicious file without displaying any warning. John Page also published proof-of-concept exploit code for the vulnerability,
“This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of VCard files.” reads the
“Crafted data in a VCard file can cause Windows to display a dangerous hyperlink. The user interface fails to provide
The expert pointed out that the exploitation of this flaw requires user interaction, the victims have to visit a specially crafted page or open a malicious file.
The flaw has received a CVSS 3.0 score of 7.8.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, vCard)
[adrotate banner=”5″]
[adrotate banner=”13″]
