Researchers Detail Windows Event Log Vulnerabilities: LogCrusher and OverLog

Cybersecurity researchers have disclosed aspects about a pair of vulnerabilities in Microsoft Windows, just one of which could be exploited to consequence in a denial-of-services (DoS).

The exploits, dubbed LogCrusher and OverLog by Varonis, acquire purpose at the EventLog Remoting Protocol (MS-EVEN), which permits remote entry to occasion logs.

Whilst the previous enables “any domain user to remotely crash the Function Log application of any Windows machine,” OverLog leads to a DoS by “filling the difficult travel space of any Windows equipment on the domain,” Dolev Taler said in a report shared with The Hacker Information.

OverLog has been assigned the CVE identifier CVE-2022-37981 (CVSS score: 4.3) and was addressed by Microsoft as component of its Oct Patch Tuesday updates. LogCrusher, however, stays unresolved.

“The efficiency can be interrupted and/or decreased, but the attacker simply cannot totally deny services,” the tech huge said in an advisory for the flaw produced previously this thirty day period.

The issues, in accordance to Varonis, lender on the actuality that an attacker can get hold of a deal with to the legacy Internet Explorer log, properly location the stage for attacks that leverage the tackle to crash the Party Log on the victim device and even induce a DoS affliction.

This is accomplished by combining it with a different flaw in a log backup function (BackupEventLogW) to consistently backup arbitrary logs to a writable folder on the qualified host till the tough generate gets stuffed.

Microsoft has because remediated the OverLog flaw by proscribing accessibility to the Internet Explorer Party Log to area directors, thus lowering the prospective for misuse.

“Though this addresses this specific set of Internet Explorer Celebration Log exploits, there continues to be likely for other user-available application Function Logs to be similarly leveraged for attacks,” Taler claimed.

Located this post intriguing? Stick to THN on Fb, Twitter  and LinkedIn to browse additional distinctive information we submit.

Some parts of this article are sourced from:
thehackernews.com