Is the aggregate severity rating of “Important” for MS13-027 too low?

Question

The Security Bulletin states that the "Maximum Security Impact" is "Elevation of Privilege"; however, the SRD blog post says code execution is possible. Additionally, SRD says "Other software that enables low-level pass-through of USB device enumeration may open additional avenues of exploitation that do not require direct physical access to the system". Further, the March Summary indicates that an exploit is likely for this vulnerability. Given all of this, how is the "Aggregate Severity Rating" not Critical? Once scenario that I'm now worried about is the maid walking around at night, owning all of the desktops on my trading floor, or any other Windows based corporate device.

EDIT: Here is the white paper the researcher published on the topic of USB.

Answer 1

I believe it may be due to the fact that it requires local access. Without low level passthrough's to USB, this can't be remotely exploited so the potential risk is fairly limited. High security environments should already have physical security to prevent rogue USB devices being installed and lower security is less of a critical target for a local targeted attack. It's probably the limitation of scope as opposed to the limited potential harm to one particular system.

Whether that is a good way to measure severity or not is hard to say, but that is my best guess as to where they are coming from.

Answer 2

I'd say that as @AJHenderson says their rating of Important is down to the requirement for physical access.

That said as with any vulnerability the actual risk to an environment needs to be assessed based on the likely threats to systems and their accessibility. In some companies the risk of this attack will be quite low (e.g. datacentre environments where physical access to systems is extremely limited), whereas in others it will be high where access is easy (e.g. any kiosk style environments that allow USB access) or where likely threat actors can get physical access to systems (e.g. financial organisations who may allow contract staff like cleaners physical access to systems (think sumitomo bank))

Ultimately I'd say that the Microsoft rating should just be seen as a starting point for a companies risk assessment and they need to take account of their own environment before deciding on how severely to treat a given issue.

Answer 3

It is the same case of Redhat explaining in their blog post why they use CVSS and don't take into account the environment and temporal (time based) values. Your question is directly related to this same procedure.

The reason why microsoft has not flagged this as overall critical is because of the environmental factor. A lot of organizations already have physcial security in place with with zero tolerance for USB devices. Even if code execution is possible, it is not remote. Attacker needs to have physical access to the machine to trigger the bug. Although just plugging in a flash drive is fast, but I think if you have phyiscal access to the system, USB is not the only vector you can compromise.

Therefore, taking into account the overall exploitation vector and the fact what new attack avenues this particular bug can introduce in an environment, the vulnerability is not rated as critical.