SecBoard
Zurück zur CVE-Übersicht

CVE-2000-1034

CRITICAL(10.0)

AV:N/AC:L/Au:N/C:C/I:C/A:C

Risk Signal Score33/100 — MITTEL
  • CVSS 10 — Kritisch

EPSS-Score

27.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

10

Technische Schwere

SecBoard-Einordnung

CVE-2000-1034 betrifft den System Monitor ActiveX-Kontrolle in Microsoft Windows 2000. Diese Schwachstelle ist ein Pufferüberlauf, der es entfernten Angreifern ermöglicht, beliebige Befehle auszuführen. Die Ursache liegt in der unzureichenden Validierung des LogFileName-Parameters in HTML-Quellcode. Dies kann zu einer vollständigen Kompromittierung des betroffenen Systems führen.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

Buffer overflow in the System Monitor ActiveX control in Windows 2000 allows remote attackers to execute arbitrary commands via a long LogFileName parameter in HTML source code, aka the "ActiveX Parameter Validation" vulnerability.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Windows 2000 Gold
  • Windows 2000 Service Pack 1

Threat-Hunting-Queries

Detection for attempts to exploit the System Monitor ActiveX control with an overly long LogFileName parameter. This is a client-side vulnerability typically exploited via malicious web pages or HTML emails.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "CLSID:C4D2D8E0-D1DD-11CE-940F-008029004347" and InitiatingProcessCommandLine contains "LogFileName" and strlen(InitiatingProcessCommandLine) > 20000 // Adjust length based on observed exploit attempts

Splunk SPL

index=* (sourcetype=WinEventLog:Application OR sourcetype=WinEventLog:System) EventCode=1000 (source_name=Application_Error OR source_name=Microsoft-Windows-WER-Diagnostics) (ProcessName=iexplore.exe OR ProcessName=outlook.exe) (Description="The instruction at "0x*" referenced memory at "0x*". The memory could not be "written"." OR Description="Application popup: iexplore.exe - Application Error : The instruction at "0x64a8e132" referenced memory at "0x006100dd". The memory could not be "written".")

Sigma

title: System Monitor ActiveX Buffer Overflow
status: experimental
description: Detects attempts to exploit CVE-2000-1034 via an overly long LogFileName parameter in the System Monitor ActiveX control.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentProcessName|endswith: ['iexplore.exe', 'outlook.exe', 'outlookexpress.exe']
    CommandLine|contains: 'CLSID:C4D2D8E0-D1DD-11CE-940F-008029004347'
    CommandLine|contains: 'LogFileName'
    CommandLine|length_gt: 20000 # Adjust length based on observed exploit attempts
  condition: selection
fields:
  - CommandLine
  - ParentProcessName
tags:
  - attack.execution
  - cve.2000.1034

Elastic ES|QL

from process where process.parent.name in ("iexplore.exe", "outlook.exe", "outlookexpress.exe") and process.command_line : "CLSID:C4D2D8E0-D1DD-11CE-940F-008029004347" and process.command_line : "LogFileName" and length(process.command_line) > 20000

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • ussrback.com

Sonstige (1)

  • CLSID:C4D2D8E0-D1DD-11CE-940F-008029004347

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*

Referenzen