Vulnerabilities > CVE-2015-2509 - Improper Access Control vulnerability in Microsoft products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-284
critical
nessus
exploit available
metasploit

Summary

Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability."

Vulnerable Configurations

Part Description Count
OS
Microsoft
4

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Exploit-Db

  • descriptionWindows Media Center - Command Execution (MS15-100). CVE-2015-2509. Remote exploit for windows platform
    fileexploits/windows/remote/38151.py
    idEDB-ID:38151
    last seen2016-02-04
    modified2015-09-11
    platformwindows
    port
    published2015-09-11
    reporterR-73eN
    sourcehttps://www.exploit-db.com/download/38151/
    titleWindows Media Center - Command Execution MS15-100
    typeremote
  • descriptionMS15-100 Microsoft Windows Media Center MCL Vulnerability. CVE-2015-2509. Remote exploit for windows platform
    fileexploits/windows/remote/38195.rb
    idEDB-ID:38195
    last seen2016-02-04
    modified2015-09-15
    platformwindows
    port
    published2015-09-15
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/38195/
    titleMS15-100 Microsoft Windows Media Center MCL Vulnerability
    typeremote

Metasploit

descriptionThis module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the *.mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution.
idMSF:EXPLOIT/WINDOWS/FILEFORMAT/MS15_100_MCL_EXE
last seen2020-06-01
modified2017-07-24
published2015-09-11
referenceshttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2509
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb
titleMS15-100 Microsoft Windows Media Center MCL Vulnerability

Msbulletin

bulletin_idMS15-100
bulletin_url
date2015-09-08T00:00:00
impactRemote Code Execution
knowledgebase_id3087918
knowledgebase_url
severityImportant
titleVulnerability in Windows Media Center Could Allow Remote Code Execution

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS15-100.NASL
descriptionThe remote Windows host is affected by a remote code execution vulnerability due to a use-after-free error in Microsoft Windows Media Center when handling specially crafted Media Center link (.mcl) files. A remote attacker can exploit this vulnerability by convincing a user to install a malicious link file, resulting in the execution of arbitrary code in the context of the current user.
last seen2020-06-01
modified2020-06-02
plugin id85884
published2015-09-10
reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/85884
titleMS15-100: Vulnerability in Windows Media Center Could Allow Remote Code Execution (3087918)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(85884);
  script_version("1.16");
  script_cvs_date("Date: 2018/11/15 20:50:31");

  script_cve_id("CVE-2015-2509");
  script_bugtraq_id(76594);
  script_xref(name:"MSFT", value:"MS15-100");
  script_xref(name:"MSKB", value:"3087918");

  script_name(english:"MS15-100: Vulnerability in Windows Media Center Could Allow Remote Code Execution (3087918)");
  script_summary(english:"Checks the version of ehshell.dll.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by a remote code execution
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is affected by a remote code execution
vulnerability due to a use-after-free error in Microsoft Windows Media
Center when handling specially crafted Media Center link (.mcl) files.
A remote attacker can exploit this vulnerability by convincing a user
to install a malicious link file, resulting in the execution of
arbitrary code in the context of the current user.");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-100");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Windows Vista, 7, 8, and
8.1.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MS15-100 Microsoft Windows Media Center MCL Vulnerability');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/09/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("misc_func.inc");

get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');
bulletin = 'MS15-100';
kb = '3087918';

kbs = make_list(kb);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);

if (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0', win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);

vuln = 0;

systemroot = hotfix_get_systemroot();
if (!systemroot) audit(AUDIT_PATH_NOT_DETERMINED, 'system root');

registry_init();
hklm = registry_hive_connect(hive:HKEY_LOCAL_MACHINE, exit_on_fail:TRUE);
win_media_center_installed = get_registry_value(handle:hklm, item:"SOFTWARE\Clients\Media\Windows Media Center\");
if(win_media_center_installed == "Windows Media Center")
  win_media_center_installed = TRUE;
else win_media_center_installed = FALSE;
RegCloseKey(handle:hklm);
close_registry();

if(!win_media_center_installed)
  audit(AUDIT_NOT_INST, "Windows Media Center");

port = kb_smb_transport();
login  = kb_smb_login();
pass   = kb_smb_password();
domain = kb_smb_domain();

if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');

winsxs = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\WinSxS", string:systemroot);
winsxs_share = hotfix_path2share(path:systemroot);

rc = NetUseAdd(login:login, password:pass, domain:domain, share:winsxs_share);
if (rc != 1)
{
  NetUseDel();
  audit(AUDIT_SHARE_FAIL, winsxs_share);
}

files = list_dir(basedir:winsxs, level:0, dir_pat:"msil_ehshell_31bf3856ad364e35_", file_pat:"^ehshell\.dll$", max_recurse:1);

# Vista
# File Only Exists of Media Center TV Pack is installed (which comes installed by OEM)
vuln += hotfix_check_winsxs(os:'6.0',
                            sp:2,
                            files:files,
                            versions:make_list('6.0.6002.19478','6.0.6002.23788'),
                            max_versions:make_list('6.0.6002.20000','6.0.6002.99999'),
                            bulletin:bulletin,
                            kb:kb);

# Windows 7
vuln += hotfix_check_winsxs(os:'6.1',
                            sp:1,
                            files:files,
                            versions:make_list('6.1.7600.17545', '6.1.7601.18968', '6.1.7601.23171'),
                            max_versions:make_list('6.1.7600.20000', '6.1.7601.20000', '6.1.7601.99999'),
                            bulletin:bulletin,
                            kb:kb);
# Windows 8
vuln += hotfix_check_winsxs(os:'6.2',
                            sp:0,
                            files:files,
                            versions:make_list('6.2.9200.17486', '6.2.9200.21601'),
                            max_versions:make_list('6.2.9200.20000', '6.2.9200.99999'),
                            bulletin:bulletin,
                            kb:kb);

# Windows 8.1
# Only Vulnerable if Windows Media Center ($10 add-on) is installed
vuln += hotfix_check_winsxs(os:'6.3',
                            sp:0,
                            files:files,
                            versions:make_list('6.3.9600.18015'),
                            max_versions:make_list('6.3.9600.99999'),
                            bulletin:bulletin,
                            kb:kb);

# cleanup
NetUseDel();

if (vuln)
{
  set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/133540/ms15_100_mcl_exe.rb.txt
idPACKETSTORM:133540
last seen2016-12-05
published2015-09-15
reportersinn3r
sourcehttps://packetstormsecurity.com/files/133540/MS15-100-Microsoft-Windows-Media-Center-MCL-Code-Execution.html
titleMS15-100 Microsoft Windows Media Center MCL Code Execution

Saint

descriptionWindows Media Center command execution
idwin_patch_mediacenter15100
titlewindows_media_center_exec
typeclient