{"id":22938,"date":"2023-09-18T16:10:45","date_gmt":"2023-09-19T00:10:45","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/09\/18\/news-16668\/"},"modified":"2023-09-18T16:10:45","modified_gmt":"2023-09-19T00:10:45","slug":"news-16668","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2023\/09\/18\/news-16668\/","title":{"rendered":"ThemeBleed exploit is another reason to patch Windows quickly"},"content":{"rendered":"

Included in the September 2023 Patch Tuesday<\/a> updates was a fix for a vulnerability which has been dubbed ThemeBleed. A Proof-of-Concept (PoC) exploit has been released<\/a> by Gabe Kirkpatrick, one of the researchers acknowledged for reporting the vulnerability.<\/p>\n

The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The ThemeBleed vulnerability was listed as CVE-2023-38146<\/a>: a Windows Themes Remote Code Execution (RCE) vulnerability.<\/p>\n

Microsoft assigned<\/a> a CVSS score<\/a> of 8.8 (out of 10) and gave it a severity rating “Important”, saying:<\/p>\n

“An attacker would need to convince a targeted user to load a Windows Themes file on a vulnerable system with access to an attacker-controlled SMB share.”<\/p><\/blockquote>\n

A .theme<\/em> file is a configuration (.ini<\/em>) text file that is divided into sections, which specify visual elements that appear on a Windows desktop. Section names are wrapped in brackets ([]) inside the .ini<\/em> file. A .theme<\/em> file enables you to change the appearance of certain desktop elements.<\/p>\n

A related file format, .themepack<\/em>, was introduced with Windows 7 to help users share themes. A .themepack<\/em> must include your .theme<\/em> file, as well as the background picture, screen saver, and icons files.<\/p>\n

Themes can be selected in the Personalization Control Panel only in Windows 7 Home Premium or higher, or only on Windows Server 2008 R2 when the Desktop component is installed.<\/p>\n

The ThemeBleed exploit is based on a race condition that can be triggered by opening a specially crafted .theme<\/em> file. A race condition, or race hazard, is the behavior of a system where the output depends on the sequence or timing of other uncontrollable events. It becomes a bug when events do not happen in the order the programmer intended.<\/p>\n

The .theme<\/em> files contain references to .msstyles<\/em> files, which should contain no code, only graphical resources that are loaded when the theme file invoking them is opened. When the .theme file is opened, the .msstyles<\/em> file will also be loaded.<\/p>\n

The researcher found that invoking a check of the theme version calls the ReviseVersionIfNecessary<\/em> function and does not safely load a signed DLL (_vrf.dll<\/em>), because the DLL is closed after verifying the signature, and then re-opened when the DLL is loaded via a call to LoadLibrary. During that interval the file could be replaced by a malicious version.<\/p>\n

Another problem lies in the fact that if a user were to download a theme from the web, this triggers the ‘mark-of-the-web’ (MOTW) warning. MOTW was originally an Internet Explorer security feature<\/a>. It broadened out into a way for your Windows devices to raise a warning when interacting with files downloaded from who-knows-where. Over time, it even contributed to preventing certain types of files from running<\/a>. However, this could be bypassed if the attacker wrapped the theme into a .themepack<\/em> file. When using the .themepack<\/em> file, the contained .theme opens automatically without serving the MOTW warning.<\/p>\n

While Microsoft’s fix has removed the functionality that triggers the theme version check to avoid the race condition, it has not fixed the more fundamental problem in the verification procedure of .msstyles<\/em> files. Nor has it added MOTW warnings to .themepack<\/em> files.<\/p>\n

The researcher notes that the vulnerability appears to be only present in Windows 11.<\/p>\n

\n

We don’t just report on vulnerabilities—we identify them, and prioritize action.<\/strong><\/p>\n

Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using Malwarebytes Vulnerability and Patch Management<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"\n\n
\n

Categories: Exploits and vulnerabilities<\/a><\/p>\n

Categories: News<\/a><\/p>\n

Tags: theme<\/p>\n

Tags: themepack<\/p>\n

Tags: Microsoft<\/p>\n

Tags: cve-2023-38146<\/p>\n

Tags: msstyles<\/p>\n

An exploit has been released for a vulnerability in .themes that was patched in the September 2023 Patch Tuesday update.<\/p>\n\n\n
\n

(Read more…<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n

The post ThemeBleed exploit is another reason to patch Windows quickly<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[30148,22783,10516,30149,32,28285,30147],"class_list":["post-22938","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-cve-2023-38146","tag-exploits-and-vulnerabilities","tag-microsoft","tag-msstyles","tag-news","tag-theme","tag-themepack"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/22938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=22938"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/22938\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=22938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=22938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=22938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}