CVE-2018-8423

Vulnerability

The vulnerability exists in the Microsoft JET Database Engine (msrd3x40.dll), affecting all supported Windows versions including Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers [1]. The bug is a memory corruption vulnerability triggered when the JET engine parses a specially crafted database file. The code path is reachable when a user (or an automated process such as a browser) opens a malicious data source, often via JavaScript or HTML that instantiates the JET engine to access a remote file. The engine is only supported in 32-bit applications, meaning 64-bit processes are not directly exploitable, but Internet Explorer on 64-bit Windows runs 32-bit rendering processes, making the attack viable through the browser [1].

Exploitation

An attacker must deliver a malicious data source file to the target. The most practical vector is via Internet Explorer: a crafted HTML page can use JET to access a data source file hosted on a remote share or local drive. On IE11, the security setting "Access data sources across domains" is disabled by default in Internet and Intranet zones, so the attack does not work from a remote website but does succeed when the malicious HTML and data source are loaded from a local drive (e.g., USB disk) or a shared folder [1]. Alternatively, an attacker can convince a user to run a malicious .js file using the 32-bit wscript.exe (found in c:\windows\SysWOW64\wscript.exe) on 64-bit systems [1]. The attacker does not require authentication or special privileges beyond getting the user to open the crafted file or HTML.

Impact

Successful exploitation results in arbitrary remote code execution in the context of the current user. An attacker can gain complete control over the affected system, including the ability to install programs, view/change/delete data, or create new accounts with full user rights. The impact is limited to the privileges of the logged-on user, but if that user has administrative rights, the attacker can take over the entire machine [1].

Mitigation

Microsoft released an official fix as part of the October 2018 Monthly Update on October 9, 2018, updating msrd3x40.dll from version 4.0.9801.0 to 4.0.9801.5 [2]. However, this patch was found to be incomplete, as the underlying vulnerability was not fully addressed. The 0patch team created a free micropatch within 24 hours of the vulnerability disclosure (September 21, 2018) and later re-micropatched over the flawed Microsoft patch to fully mitigate the issue [1][2]. Users should apply the latest official updates from Microsoft and consider using 0patch's micropatches as an additional layer of defense. No workaround other than avoiding the use of JET engine from untrusted data sources is available [1].