Researchers from Varonis Systems Inc.’s Threat Labs today detailed a pair of vulnerabilities in Microsoft Corp.’s Windows operating system that can still be exploited, despite a partial patch being issued for one of them.

Under the theme of “The Logging Dead,” — yes, Halloween is around the corner — the two event vulnerabilities are described as “haunting Windows” because they’re related to Internet Explorer’s deep integration into the Windows operating system. Support from Microsoft from IE ended in June, but the integration of specific features remains, hence the two vulnerabilities.

In this case, an Internet Explorer-specific Event Log remains on all current Windows operating systems. The IE-specific Event Log has a distinct set of permissions, which is where the two vulnerabilities occur.

The first, dubbed LogCrusher, allows any domain user to remotely crash the Event Log application of any Windows machine on the domain. The second, OverLog, causes a remote denial-of-service attack by filling the hard drive space of any Windows machine. Both exploits use functions from the Microsoft Event Log Remoting Protocol that allows for remote manipulation of a machine’s event logs.

On the technical side, LogCrusher is a logic bug in ElfClearELFW, a function in MS-EVEN that allows administrators to remotely clear and back up event logs. The issue arises in that ElfClearELFW does not like a pointer to NULL in the back up file name structure, causing it to crash. 

The risk with LogCrusher is that many security controls rely on the normal operation of the Event Logs service. Without logs, security control becomes blind and security control products that attach themselves to the service also crash alongside it. This could allow an attacker to use any type of usually detected exploit or attack with impunity as alerts will not be triggered.

OverLog uses a similar methodology, the “internet explorer” Event Log handle and another vulnerability in the BackupEventLogW function, to cause permanent denial of service for every Windows machine.

According to the Varonis researchers, Microsoft has opted not to do a full fix for the LogCrunch vulnerability in Windows 10, with a partial patch released on the most recent Patch Tuesday. OverLog was not addressed. The researchers did send details and corresponded with Microsoft about the two vulnerabilities since May, but with the vulnerabilities not fully addressed, they are now going public with the details.

Image: Varonis