{"id":2344,"date":"2019-01-16T06:39:27","date_gmt":"2019-01-16T06:39:27","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=1735"},"modified":"2022-12-02T15:39:54","modified_gmt":"2022-12-02T10:09:54","slug":"microsoft-zero-day-vcard-vulnerability","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/microsoft-zero-day-vcard-vulnerability\/","title":{"rendered":"Microsoft Zero Day – VCard Vulnerability"},"content":{"rendered":"


\nIn this blog we are going to discuss about Microsoft Zero Day – VCard Vulnerability For Windows operating system.<\/p>\n

Introduction Microsoft Zero Day – VCard Vulnerability:<\/strong><\/h3>\n

A zero day vulnerability has been discovered and reported in the Microsoft’s Windows operating system. Under a certain scenario it could allow a remote attacker to execute arbitrary code on Windows machine. A remote attacker can maliciously craft a VCard file in a way that the contact’s website URL stored within the file points to a local executable file, which can be sent within a zipped file via an email or delivered separately via drive-by-download techniques.<\/p>\n

If a victim clicks ton suspicious website URL, the Windows operating system would run the malicious executable without displaying any warning, instead of opening the web address on the browser. Although the attack requires user’s interaction, leaving the vulnerability unpatched would leave an opportunity for sophisticated attackers to target Windows users at large.<\/p>\n

\"Microsoft<\/a><\/p>\n

A vCard is an electronic business (or personal) card and also the name of an industry specification for the kind of communication exchange that is done on business or personal cards. It may have seen a vCard attached to an e-mail note someone has sent you. Because vCard is a published industry specification, software application developers can create programs that process vCards by letting you view them, or drag-and-drop them to an address book or some other application. vCards can include images and sound as well as text.<\/p>\n

A promising future use of a vCard will be as a way to quickly fill in application forms on the Web. Just drag-and-drop your own vCard to the form and you won’t have so many blanks to fill in. For software developers, there is a Personal Data Interchange (PDI) Software Development Kit (SDK). The specification is located at the Internet Mail Consortium’s Web site where you can also find out about vCalendar , a similar exchange standard for personal time scheduling.<\/p>\n

\"Exporting<\/a><\/p>\n

Figure: Exporting contacts in vCard format<\/em><\/strong><\/h6>\n

 <\/p>\n

Attack Scenario?<\/strong><\/h3>\n

\"Attack<\/a><\/p>\n