A vulnerability affecting all versions of Windows was publicly released on September 20th [1]. If exploited, this vulnerability could allow an unauthenticated attacker to perform remote code execution on vulnerable systems. The cause of the vulnerability is found in the Microsoft JET Database Engine, which allows threat actors to perform an out-of-bounds write. There is a medium-high confidence rating that threat actors will act to quickly weaponize this vulnerability as Microsoft has not released a security patch and Proof-of-Concept code has been made publicly available [2].
What we’re doing about it
- The eSentire Threat Intelligence team is monitoring this topic for additional information
- esRECON will update its vulnerability plugins as updates become available to assist in identifying and remediating this 0-day
What you should do about it
- Apply the Microsoft security patch once it has been made available
- Conduct user awareness training around phishing and avoiding opening documents from unknown or suspicious sources
Additional information
In an attack scenario, a threat actor would send a maliciously crafted file with data stored in the JET database format or add the malicious document to a compromised website. If the attachment is opened the malicious file will execute [3].The Microsoft JET Database Engine can be exploited due to an issue with index management to cause an out-of-bounds write; this is when data is written past the end or before the beginning of the intended buffer. Out-of-bound writes can result in data corruption, software crashes or code execution.
The Jet Database Remote Code Execution vulnerability was publicly disclosed before security patching due to a 120-day notification deadline not being met. The vulnerability was initially reported to Microsoft on May 8th and the development of a security patch is reported as ongoing.
References:
[1] (0Day) Microsoft Windows Jet Database Engine Out-Of-Bounds Write Remote Code Execution Vulnerability
https://www.zerodayinitiative.com/advisories/ZDI-18-1075/
[2] ZDI-CAN-6135: A REMOTE CODE EXECUTION VULNERABILITY IN THE MICROSOFT WINDOWS JET DATABASE ENGINE
https://github.com/thezdi/PoC/tree/master/ZDI-18-1075
[3] ZDI-CAN-6135: A REMOTE CODE EXECUTION VULNERABILITY IN THE MICROSOFT WINDOWS JET DATABASE ENGINE
https://www.thezdi.com/blog/2018/9/20/zdi-can-6135-a-remote-code-execution-vulnerability-in-the-microsoft-windows-jet-database-engine
